SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?
⚠ Common exam trap
Many candidates confuse SCPs with IAM policies or permissions boundaries, thinking that IAM-level controls are sufficient for cross-account isolation, when in fact only SCPs at the OU level can enforce a hard deny across all accounts in an organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.
AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.
Why it's wrong here
Tags can be changed; SCPs at OU level are more effective.
- ✗
Create a single OU for all accounts and use IAM permissions boundaries to restrict access.
Why it's wrong here
Permissions boundaries are per-role and do not prevent cross-account access at the organization level.
- ✗
Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.
Why it's wrong here
Does not prevent access to resources that are not shared; SCP is more comprehensive.
- ✓
Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.
Why this is correct
This enforces data residency at the organizational level.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.