SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently think SCPs can restrict root user actions, but AWS explicitly exempts the root user from SCPs, making option E ineffective for monitoring or prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.
Amazon CloudTrail logs root user login events as 'RootLogin' events, which can be captured by an Amazon CloudWatch Events rule (now Amazon EventBridge). This rule can trigger an Amazon SNS notification to alert the security team in real time, ensuring immediate awareness of root activity. Option D is correct because AWS CloudTrail must be enabled in all accounts to record root user API calls; without CloudTrail, there is no audit trail for root actions, making monitoring impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.
Why this is correct
Alerts on root user activity.
- ✗
Use AWS Config rules to detect root user usage.
Why it's wrong here
AWS Config does not track user actions.
- ✗
Create an IAM role for root user with limited permissions.
Why it's wrong here
Root user cannot use IAM roles.
- ✓
Enable AWS CloudTrail to log root user API calls in all accounts.
Why this is correct
CloudTrail records root user actions.
- ✗
Attach a service control policy (SCP) to all accounts to deny root user actions.
Why it's wrong here
SCPs cannot restrict root user in member accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.