SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with multiple accounts. The network team wants to centrally manage Amazon VPC IP addresses using Amazon VPC IP Address Manager (IPAM). They have enabled IPAM in the management account and delegated an administrator account. However, the delegated administrator account cannot create IPAM pools. What is the most likely cause?
⚠ Common exam trap
Many candidates assume delegation in AWS Organizations automatically grants full administrative permissions, but in reality, IAM policies are still required for the delegated account to perform specific actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The delegated administrator account does not have the required IAM permissions to manage IPAM
When you delegate an administrator account for IPAM in AWS Organizations, that account still requires explicit IAM permissions to perform IPAM actions such as creating pools. The delegation only allows the account to manage IPAM resources on behalf of the organization; it does not automatically grant the necessary IAM permissions. Without a policy that allows actions like `ec2:CreateIpamPool`, the delegated administrator will receive an authorization error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The delegated administrator account does not have the required IAM permissions to manage IPAM
Why this is correct
IAM permissions are necessary for the delegated account to perform IPAM actions.
- ✗
IPAM must be used only from the management account and cannot be delegated
Why it's wrong here
IPAM supports delegated administrators.
- ✗
IPAM is not supported in the AWS Region where the delegated administrator account operates
Why it's wrong here
IPAM is supported in most commercial regions.
- ✗
An SCP in the organization denies IPAM actions for all accounts
Why it's wrong here
If SCP denied IPAM, the management account would also be affected.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.