SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?
⚠ Common exam trap
Candidates often confuse the direction of the trust relationship, mistakenly thinking the role must be in the source account (dev) rather than the target account (production), or they overlook that both a trust policy and an IAM permissions policy are required for cross-account access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.
Cross-account IAM role access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal, and an IAM policy in the source account that grants the sts:AssumeRole action for that role's ARN. This two-part configuration establishes a secure delegation path where the dev account's users or roles can request temporary credentials from the production account via the AWS Security Token Service (STS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A role in the dev account with permissions to access production resources.
Why it's wrong here
The role must be in the target account.
- ✗
An IAM user in the production account with permissions to switch roles.
Why it's wrong here
Roles are assumed, not users.
- ✓
A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.
Why this is correct
This is the standard cross-account role access setup.
- ✗
An SCP that allows sts:AssumeRole from the dev account.
Why it's wrong here
SCPs are not for granting cross-account access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?
easy- A.A VPC peering connection between the accounts
- ✓ B.An IAM role in the production account with a trust policy allowing the development account
- C.A service control policy (SCP) that permits AssumeRole
- D.An AWS Config rule to validate the role
Why B: Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.