SCS-C02 Management and Security Governance Practice Question
A company is using AWS Organizations and wants to delegate the administration of certain accounts to different teams. For example, the finance team should be able to manage billing-related accounts, but not development accounts. Which AWS feature allows this type of delegation?
⚠ Common exam trap
SCS-C02 often tests the distinction between SCPs (permission guardrails) and delegated administrator (service-specific administrative delegation), causing candidates to pick SCPs when the question asks for delegation of administration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Organizations delegated administrator
AWS Organizations delegated administrator allows a member account to be designated as the administrator for a specific AWS service (e.g., AWS Billing, AWS CloudFormation StackSets, AWS Config) across the organization. This enables the finance team's account to manage billing-related accounts without granting them full management over development accounts. It is the only feature that provides service-specific administrative delegation within Organizations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Organizations delegated administrator
Why this is correct
AWS Organizations delegated administrator is a native feature that lets you designate a member account as the administrative owner for a specified AWS service across the entire organization. For example, a finance account can be registered to manage Cost Explorer and billing reports for all accounts, so finance staff can perform service-specific administrative tasks without needing the management account's root user. This provides centralized, org-wide service administration while preserving the principle of least privilege.
- ✗
AWS IAM Identity Center (AWS SSO)
Why it's wrong here
AWS IAM Identity Center (formerly AWS SSO) centrally manages workforce user identities and provides single sign-on to AWS accounts and business applications. It does not delegate administrative authority over a service to a member account; it merely controls which users can authenticate and what permissions they receive after federation. Delegated administration is an organization-level permission model, not an identity/access portal.
- ✗
Service control policies (SCPs)
Why it's wrong here
Service control policies (SCPs) are organization-level guardrails that define the maximum permissions available to accounts and resource types within the organization. They only restrict or allow API actions, and they never grant anyone administrative capabilities; instead, they constrain what even a delegated administrator can do. Thus, SCPs complement delegation by limiting its scope rather than establishing it.
- ✗
IAM roles in each account
Why it's wrong here
Configuring IAM roles in each account requires manually creating a role in every account and establishing trust relationships so that a central user can assume it. This approach works for individual cross-account access but does not provide the native, org-wide, service-specific administrative capability that AWS Organizations delegated administrator offers. It also becomes unwieldy at scale because every account must be updated independently when the administration model changes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.