SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.
Service Control Policies (SCPs) can be used to enforce that CloudTrail and AWS Config are enabled and cannot be disabled by member accounts. Option B is wrong because CloudFormation StackSets require manual deployment to each account and do not prevent disabling. Option C is wrong because IAM permissions boundaries do not enforce service enablement. Option D is wrong because AWS Config conformance packs deploy rules but cannot enforce CloudTrail enablement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.
Why this is correct
Service Control Policies (SCPs) allow you to centrally control which AWS services and actions are allowed or denied across all accounts in an organization. By creating SCPs that deny actions that disable CloudTrail or AWS Config, you can enforce that these services remain enabled in all accounts, including new accounts that are created.
- ✗
Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.
Why it's wrong here
AWS CloudFormation StackSets can deploy CloudTrail and AWS Config resources to multiple accounts, but they do not prevent users from disabling these services afterwards. This solution does not enforce continuous compliance.
- ✗
Use IAM permissions boundaries to restrict what users can do in each account.
Why it's wrong here
IAM permissions boundaries control the maximum permissions that an IAM entity can have, but they do not enforce the enablement of services like CloudTrail or AWS Config. They are not suitable for this requirement.
- ✗
Use AWS Config conformance packs to deploy rules across accounts.
Why it's wrong here
AWS Config conformance packs can deploy a set of AWS Config rules and remediation actions, but they cannot enforce that CloudTrail is enabled. They also do not prevent disabling of services.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.