SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?
⚠ Common exam trap
A common mix-up: candidates assume SCPs can enforce configurations like password policies or MFA, but SCPs only deny or allow actions, not set or enable features, so detection and remediation require AWS Config or similar services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.
SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an SCP to enforce a specific password policy and require MFA across all accounts.
Why it's wrong here
SCPs cannot enforce a password policy or require MFA; they only deny or allow actions.
- ✗
Use AWS Config rules to automatically set the password policy and enable MFA for all users.
Why it's wrong here
AWS Config rules can detect but not remediate automatically unless combined with custom automation.
- ✓
Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.
Why this is correct
SCPs can block actions that modify the password policy or deactivate MFA, and AWS Config can detect non-compliant users.
- ✗
Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.
Why it's wrong here
CloudTrail logs but does not enforce or remediate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.