SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by considering VPNs or custom scripts, when the most scalable and operationally efficient approach is to use CloudFormation StackSets with a service-managed permission model to deploy a standardized stack across the entire organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.
CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.
Why it's wrong here
AWS Config rules are detective and evaluate after the fact, so remediation lags and Lambda must be deployed per account and region. It is tempting because Config conformance packs genuinely audit resource state, and would be correct for detecting non-compliant resources rather than provisioning logging centrally.
- ✓
Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.
Why this is correct
StackSets deploys the flow-log stack across every account and region from a single administration, using service-managed permissions so new accounts inherit it automatically. This satisfies the hundreds-of-accounts scale constraint, unlike per-account scripting, and centralises delivery to the security account's S3 bucket.
- ✗
Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.
Why it's wrong here
A custom script still requires credentials and execution in every account and region, so operational overhead scales with account count. It is tempting because API automation removes manual console work, and would be correct for one-off or small-scale deployments outside AWS Organizations.
- ✗
Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.
Why it's wrong here
Flow logs are delivered by the VPC service to S3 directly; a per-account VPN adds tunnels, routing and cost without carrying log data, and an S3 endpoint in another account is not reachable over that VPN. VPNs suit encrypted connectivity between on-premises networks and AWS, not log aggregation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.