SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?
⚠ Common exam trap
A common mix-up: candidates confuse Service Control Policies (SCPs) with IAM policies, thinking SCPs can grant permissions, when in fact SCPs only provide a guardrail by denying or allowing permissions that are then further restricted by IAM policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.
It uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.
Why this is correct
Cross-account IAM roles allow centralized management without sharing credentials.
- ✗
Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.
Why it's wrong here
Systems Manager requires IAM roles for cross-account management.
- ✗
Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.
Why it's wrong here
SCPs do not grant permissions; they only restrict them.
- ✗
Share the EC2 console credentials of each account with the DevOps team.
Why it's wrong here
Sharing credentials is a security risk and not scalable.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.