The correct answer is a role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole. This works because cross-account IAM role assumption between AWS accounts requires a two-sided permission model: the target account must explicitly trust the source account via a role’s trust policy, and the source account must grant its users the ability to call the STS AssumeRole API. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this concept tests your understanding of delegated access without sharing long-term credentials, often appearing in multi-account architecture scenarios. A common trap is confusing Service Control Policies (SCPs) with trust policies—SCPs can block but never grant cross-account access. Another pitfall is assuming you can directly assign a role to a user; instead, the user must be allowed to assume the role. Memory tip: think of it as a two-key lock—the target account holds the lock (trust policy) and the source account holds the key (sts:AssumeRole permission).
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.
Option C is correct because cross-account access requires both a trust policy in the production account allowing the dev account to assume the role, and an IAM policy in the dev account granting sts:AssumeRole. Option A is wrong because SCPs are not used for cross-account role assumption. Option B is wrong because roles are assumed, not users. Option D is wrong because a role must exist in the target account.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A role in the dev account with permissions to access production resources.
Why it's wrong here
The role must be in the target account.
✗
An IAM user in the production account with permissions to switch roles.
Why it's wrong here
Roles are assumed, not users.
✓
A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.
Why this is correct
This is the standard cross-account role access setup.
Related concept
Read the scenario before looking for a memorised answer.
✗
An SCP that allows sts:AssumeRole from the dev account.
Why it's wrong here
SCPs are not for granting cross-account access.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which SAP-C02 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole. — Option C is correct because cross-account access requires both a trust policy in the production account allowing the dev account to assume the role, and an IAM policy in the dev account granting sts:AssumeRole. Option A is wrong because SCPs are not used for cross-account role assumption. Option B is wrong because roles are assumed, not users. Option D is wrong because a role must exist in the target account.
What should I do if I get this SAP-C02 question wrong?
Identify which SAP-C02 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?
easy
A.A VPC peering connection between the accounts
✓ B.An IAM role in the production account with a trust policy allowing the development account
C.A service control policy (SCP) that permits AssumeRole
D.An AWS Config rule to validate the role
Why B: Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.