SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?
⚠ Common exam trap
Many candidates confuse AWS Control Tower Account Factory Customization with AWS CloudFormation StackSets, but StackSets lack the automatic triggering mechanism tied to new account creation in an OU, which AFC provides natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Control Tower Account Factory Customization (AFC).
AWS Control Tower Account Factory Customization (AFC) is designed to automatically apply custom CloudFormation templates to new accounts provisioned through Account Factory within a specified OU. It uses lifecycle events to trigger the deployment, ensuring that every new account in the OU receives the baseline configuration without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Service Catalog portfolio to share templates.
Why it's wrong here
Service Catalog does not automate deployment.
- ✗
Use AWS Lambda with lifecycle hooks in AWS CloudFormation.
Why it's wrong here
Lifecycle hooks are not part of Control Tower.
- ✗
Use AWS CloudFormation StackSets and manually trigger them for new accounts.
Why it's wrong here
Manual trigger is not automated.
- ✓
Use AWS Control Tower Account Factory Customization (AFC).
Why this is correct
AFC automatically deploys custom templates to new accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?
medium- ✓ A.Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.
- B.Manually enable Shield Advanced in each account after creation.
- C.Use AWS Config to detect accounts without Shield Advanced and send notifications.
- D.Use AWS Organizations to create an SCP that requires Shield Advanced.
Why A: AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.