SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?
⚠ Common exam trap
Watch out — candidates often choose a detective or reactive solution (like AWS Config or Lambda) because they overlook the requirement to *prevent* the action, or they mistakenly believe IAM policies attached to users are sufficient to block all principals, including the root user and cross-account roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.
Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Lambda to re-enable GuardDuty if it is disabled.
Why it's wrong here
This is reactive and does not prevent the disable action.
- ✗
Create an AWS Config rule to detect disabled GuardDuty and send alerts.
Why it's wrong here
Detection alone does not prevent disabling.
- ✓
Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.
Why this is correct
SCPs prevent the actions across all accounts in the OU, regardless of user permissions.
- ✗
Attach an IAM policy to each user that denies guardduty:Disable* actions.
Why it's wrong here
Users with admin access can bypass IAM policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.