SOA-C02 Deployment, Provisioning, and Automation Practice Question
A company has multiple AWS accounts managed under AWS Organizations. The SysOps administrator needs to deploy a common AWS CloudFormation template to all accounts in a specific organizational unit (OU), ensuring consistent security group configurations across the organization. Which AWS service should the administrator use to perform this deployment?
⚠ Common exam trap
Watch out — candidates often confuse AWS Service Catalog as a deployment mechanism for multi-account rollouts, but it is a governance tool for end-user provisioning, not an automated push deployment service like StackSets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudFormation StackSets
AWS CloudFormation StackSets extends the functionality of CloudFormation by allowing you to deploy a common template across multiple accounts and regions from a single management account. In this scenario, the administrator can target the specific organizational unit (OU) within AWS Organizations, ensuring consistent security group configurations are applied to all member accounts without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS CloudFormation StackSets
Why this is correct
AWS CloudFormation StackSets is the correct choice because it is purpose-built to deploy the same CloudFormation template across many accounts and regions from a single operation. With service-managed permissions, StackSets integrates natively with AWS Organizations, letting the sysops admin target entire organizational units (OUs) and automatically handle account addition/removal without custom roles or scripts. This delivers the least operational overhead for centralized, standardized stack deployment.
- ✗
AWS CodePipeline with cross-account actions
Why it's wrong here
AWS CodePipeline with cross-account actions can technically deploy stacks into multiple accounts, but it requires the sysops admin to build a separate pipeline stage or action per target account, configure cross-account KMS keys, S3 artifact buckets, and IAM roles, and manually maintain the account list. Unlike StackSets, it does not dynamically discover or target accounts via AWS Organizations OUs, so every account change triggers pipeline maintenance. This makes it significantly more operationally overhead than a StackSet.
- ✗
AWS Service Catalog portfolio
Why it's wrong here
AWS Service Catalog portfolio lets administrators create and share approved CloudFormation products that users can provision on demand, but it does not push deployments automatically to every account in an OU. Each target account's users would have to launch the product individually, or the admin would need separate automation to invoke provisioning, which does not guarantee uniform, consistent deployment at scale. The service is designed for governed self-service, not bulk multi-account stack orchestration.
- ✗
AWS Systems Manager Automation
Why it's wrong here
AWS Systems Manager Automation is designed to run runbooks against individual resources, such as patching an EC2 instance or configuring a single account's resource. Although an Automation runbook could invoke cross-account roles to create stacks, there is no native capability to fan out a CloudFormation template across all accounts and regions in an organization with automatic OU membership tracking. Building that would require custom scripted loops and per-account IAM trust relationships, adding operational complexity and making it a poor fit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.