SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?
⚠ Common exam trap
Test-takers frequently confuse tag policies with SCPs or AWS Config rules, thinking that SCPs alone can enforce tag requirements, but SCPs only block actions based on existing tags and cannot enforce tag key presence for all services, whereas tag policies provide a centralized, organization-wide mechanism for defining and enforcing tag schemas.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use tag policies in AWS Organizations to enforce required tags on resources.
Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define cost allocation tags in the management account and activate them for all accounts.
Why it's wrong here
Cost allocation tags need to be activated per account, but they do not enforce tagging.
- ✗
Use AWS Config rules to automatically tag resources after creation.
Why it's wrong here
Config rules can remediate but do not enforce at creation.
- ✗
Use an SCP that denies resource creation if the required tags are not present.
Why it's wrong here
SCPs cannot enforce tagging; they only control permissions.
- ✓
Use tag policies in AWS Organizations to enforce required tags on resources.
Why this is correct
Tag policies can enforce tagging across all accounts.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.