SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?
⚠ Common exam trap
A common mix-up: candidates confuse service control policies (SCPs) with proactive enforcement, but SCPs only restrict permissions and cannot automatically enable a service; they also overlook that CloudFormation StackSets cannot enable a service like GuardDuty, which requires a specific API action rather than resource deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization
AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudFormation StackSets to deploy GuardDuty in each account
Why it's wrong here
Possible but not the most straightforward centralized approach.
- ✗
Enable GuardDuty manually in each member account by logging into each account
Why it's wrong here
This is not centralized.
- ✗
Create a service control policy to force GuardDuty to be enabled
Why it's wrong here
SCPs cannot enable services.
- ✓
Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization
Why this is correct
Delegated administrator can enable GuardDuty across all accounts via API.
- ✓
Designate a member account as the GuardDuty delegated administrator
Why this is correct
Delegated administrator can manage GuardDuty across the organization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.