SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?
⚠ Common exam trap
Candidates often confuse SCPs with deployment mechanisms—SCPs only deny or allow actions, they cannot create resources, so StackSets (or similar) are required for deployment, and Control Tower guardrails are often mistaken for being able to deploy custom resources when they only enforce pre-defined policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.
It combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.
Why this is correct
SCPs in AWS Organizations deny the `cloudtrail:StopLogging` and `config:DeleteConfigurationRecorder` actions at the organisation root, so member accounts cannot disable the controls regardless of their own IAM permissions. StackSets then deploys the CloudTrail trail and Config rules automatically to every account, including newly created ones.
- ✗
Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.
Why it's wrong here
IAM roles and Lambda monitoring are reactive and per-account; a Lambda detecting a disabled trail cannot prevent the disabling, and nothing automatically provisions the baseline in new accounts. This is tempting because Lambda can remediate drift, and it would be correct for detecting and repairing non-compliance after the fact.
- ✗
Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.
Why it's wrong here
Control Tower preventive guardrails are SCPs, which block actions but do not themselves deploy a CloudTrail trail or Config rules into each account; the baseline comes from its landing zone and account factory. Guardrails are tempting because they enforce controls, and they would be correct for restricting disallowed configurations.
- ✗
Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.
Why it's wrong here
SCPs restrict API actions but cannot deploy CloudFormation StackSets or provision CloudTrail and AWS Config resources; they only deny or allow. SCPs are tempting because they enforce that accounts cannot disable controls, and they would be correct for permission boundaries, but deployment needs a separate mechanism.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?
medium- A.Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.
- B.Use AWS Systems Manager Automation to apply the baseline to new accounts.
- ✓ C.Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.
- D.Use AWS Config aggregators to apply the baseline controls to new accounts.
Why C: AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.