SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?
⚠ Common exam trap
Many exam-takers confuse SCPs with proactive resource provisioning, assuming an SCP can enable a service, when in reality SCPs only control permissions and cannot perform actions like subscribing to Shield Advanced.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.
AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.
Why this is correct
This automates the setup for all new and existing accounts.
- ✗
Manually enable Shield Advanced in each account after creation.
Why it's wrong here
Manual process is not efficient and prone to error.
- ✗
Use AWS Config to detect accounts without Shield Advanced and send notifications.
Why it's wrong here
Detection alone does not enable Shield Advanced.
- ✗
Use AWS Organizations to create an SCP that requires Shield Advanced.
Why it's wrong here
SCPs cannot enable services; they only control permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.