SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?
⚠ Common exam trap
Candidates often confuse the prerequisite of an existing AWS Organizations management account with the need for a pre-configured landing zone, mistakenly thinking Control Tower requires an already-built environment rather than building it itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An AWS Organizations management account.
AWS Control Tower requires an AWS Organizations management account because Control Tower uses Organizations to create and manage accounts, apply service control policies (SCPs), and enforce guardrails across the organization. The management account serves as the central point for all administrative actions, and without it, Control Tower cannot establish the necessary multi-account structure or landing zone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A pre-configured landing zone.
Why it's wrong here
A landing zone is the product Control Tower itself provisions, not something supplied beforehand; the actual prerequisite is a management account plus identity and billing setup. It tempts because Control Tower's whole purpose is landing-zone governance, but you cannot pre-configure what the service is meant to build.
- ✓
An AWS Organizations management account.
Why this is correct
Control Tower is built on AWS Organizations and provisions its landing zone from the organisation's management account, which must exist and have all features enabled. Without that management account, Control Tower cannot create organisational units, accounts or guardrails.
- ✗
At least three organizational units (OUs).
Why it's wrong here
Control Tower requires at least two OUs, not three; it creates foundational and additional OUs during landing zone setup. Three OUs is a design preference for separating workloads, not a prerequisite, so this overstates the minimum.
- ✗
Existing AWS Config rules in all accounts.
Why it's wrong here
Control Tower creates and manages its own AWS Config rules as part of the landing zone; pre-existing rules are not required and can conflict with the managed baseline. Config rules are tempting because they underpin detective controls, but they are an output of enrolment, not an input prerequisite.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.