SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?
⚠ Common exam trap
Test-takers frequently confuse AWS Config's automatic remediation with custom event-driven approaches (like Lambda or CloudWatch Events) or mistakenly think SCPs can remediate resources, when in fact SCPs only prevent non-compliant actions from being taken, not fix existing non-compliant resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts
It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Lambda function in each account that periodically checks Config rules and triggers remediation
Why it's wrong here
Polling Config rules from per-account Lambda functions adds latency and duplicated logic, and each function needs its own IAM role, so remediation drifts across accounts. Lambda is for custom compute, not orchestration; it would suit bespoke remediation logic that Automation documents cannot express.
- ✗
Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions
Why it's wrong here
Per-account CloudWatch Events rules invoking Lambda duplicate configuration across every account and require Lambda code to start Automation executions, rather than letting Config invoke the document directly. Event-driven Lambda suits custom workflows, not standard Config remediation.
- ✓
Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts
Why this is correct
Automatic remediation must run locally in each account so SSM Automation can act on that account's resources without cross-account role sprawl; the aggregator then gives central visibility. This satisfies the scalability and security constraints by keeping remediation scoped per account while consolidating compliance monitoring.
- ✗
Use AWS Organizations service control policies to automatically remediate non-compliant resources
Why it's wrong here
SCPs only deny or allow API actions at the Organizations level; they cannot invoke Systems Manager Automation documents or read Config compliance state, so no remediation occurs. SCPs are the right tool for enforcing guardrails such as blocking public S3 buckets outright.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.