SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?
⚠ Common exam trap
Test-takers frequently confuse service control policies (SCPs) with IAM policies, thinking SCPs can grant cross-account access, but SCPs only act as a guardrail and cannot allow access that isn't already explicitly granted by IAM policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it
It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a service control policy to allow access from other accounts
Why it's wrong here
SCPs do not grant access; they restrict permissions.
- ✗
Create IAM users in the development account for each developer
Why it's wrong here
This requires managing users across accounts and is not scalable.
- ✗
Share the access keys of an IAM user in the development account
Why it's wrong here
Sharing access keys is a security risk.
- ✓
Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it
Why this is correct
This follows AWS best practices for cross-account access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.