The correct answer is to attach a Service Control Policy (SCP) that denies the effect of actions modifying billing preferences to the root OU. This is correct because an SCP applied at the root OU cascades to all member accounts and can restrict permissions for every principal, including the root user, making it the only mechanism that can universally block billing modifications without enumerating allowed read-only actions. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of SCPs as a preventive guardrail for centralized security controls, often appearing in questions about enforcing immutable billing settings across an organization. A common trap is choosing an IAM policy or a read-only managed policy, which cannot restrict the root user or apply organization-wide. Memory tip: SCPs are the “root-level veto” — they deny actions at the top so no account can override them.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An SCP that denies the effect of actions that modify billing preferences.
Option D is correct because a Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
An SCP that allows only read-only billing actions.
Why it's wrong here
SCPs cannot allow actions; they only deny or allow by default.
✗
An SCP that denies all billing-related actions except read-only.
Why it's wrong here
This would deny read access as well.
✗
An IAM policy attached to the root OU that denies billing modifications.
Why it's wrong here
IAM policies cannot be attached to OUs; they are attached to users/groups/roles.
✓
An SCP that denies the effect of actions that modify billing preferences.
Why this is correct
An SCP can deny actions like 'aws-portal:ModifyAccount' and 'aws-portal:ModifyBilling'.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse SCPs with IAM policies, thinking an IAM policy can be attached to an OU, or they incorrectly assume that an Allow-only SCP is the simplest way to restrict actions, when in reality a targeted Deny SCP is more precise and maintainable for blocking specific modification actions while allowing all other billing read actions by default.
Detailed technical explanation
How to think about this question
SCPs use an implicit deny model where any action not explicitly allowed is denied, but the recommended pattern for restricting specific high-risk actions is to use a Deny statement with a condition or action list, as this overrides any Allow from other policies (including IAM permissions boundaries). The billing modification actions include 'aws-portal:ModifyAccount', 'aws-portal:ModifyBilling', and 'aws-portal:ModifyPaymentMethods', which are part of the AWS Billing and Cost Management console actions. By attaching a Deny SCP to the root OU, the policy applies to all accounts in the organization, including the management account, unless explicitly excluded.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An SCP that denies the effect of actions that modify billing preferences. — Option D is correct because a Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.