SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse AWS Config (a detective control) with a provisioning tool, and assuming SCPs can create resources when they only enforce permission boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a StackSet with the template and target the OU, enabling automatic deployment.
AWS CloudFormation StackSets allow you to deploy a common CloudFormation template across multiple accounts and regions. By targeting an organizational unit (OU) and enabling automatic deployment, any new account added to that OU will automatically receive the defined resources, fulfilling the automation requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a StackSet with the template and target the OU, enabling automatic deployment.
Why this is correct
Automatically deploys to new accounts in the OU.
- ✓
Create an AWS CloudFormation template that defines the common resources.
Why this is correct
StackSets use CloudFormation templates.
- ✗
Use AWS Config rules to detect missing resources and deploy them via Lambda.
Why it's wrong here
This is a custom solution, not as automated as StackSets.
- ✓
Enable AWS CloudFormation StackSets trusted access with AWS Organizations.
Why this is correct
Required for StackSets to manage accounts in the organization.
- ✗
Create an SCP that requires the creation of those resources.
Why it's wrong here
SCPs cannot create resources.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?
easy- A.Create an IAM role in each member account that allows CloudFormation to create resources.
- B.Create an SCP that allows CloudFormation to create S3 buckets.
- ✓ C.Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.
- ✓ D.Create a CloudFormation StackSet in the management account.
- ✓ E.Configure the StackSet with the target accounts and regions, and specify an IAM role for execution.
Why C: The CloudFormation template must define the S3 bucket resource with default encryption enabled (e.g., using the `BucketEncryption` property with `AES256` or `aws:kms`) to meet the requirement. Without this configuration in the template, the deployed bucket would not have default encryption, failing the central team's objective.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.