SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?
⚠ Common exam trap
Candidates often think a Lambda function or AWS Config is needed for automation, but AWS Transit Gateway Network Manager provides a native, policy-driven way to automatically accept attachments based on tags, which is simpler and more secure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.
AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.
Why it's wrong here
This adds complexity and is not a native solution.
- ✗
Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.
Why it's wrong here
SCPs cannot create attachments.
- ✓
Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.
Why this is correct
Network Manager can auto-accept attachments based on tags.
- ✗
Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.
Why it's wrong here
Manual approval does not meet the automatic requirement.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.