ORG AWS Organizations - SAP-C02 Practice Questions

Master multi-account strategy, organizational units, service control policies, delegated administration, consolidated billing, and governance at scale.

19Questions Available
2Exam Domains

Practice Organizations Questions Now

Start a timed practice session focusing on AWS Organizations topics from the SAP-C02 question bank.

Start SAP-C02 Practice Quiz →

SAP-C02 Organizations Question Bank (19 Questions)

Browse all 19 practice questions covering AWS Organizations for the SAP-C02 certification exam. Answers are intentionally hidden on this page so you can self-test first before checking results in quiz mode.

  1. Question 1Design Solutions for Organizational Complexity

    An enterprise is designing a multi-account strategy using AWS Organizations. The security team wants to prevent any account from leaving the organization. Which control achieves this?

    AEnable MFA Delete on all S3 buckets
    BAttach an SCP to the root that denies organizations:LeaveOrganization
    CUse IAM permission boundaries to restrict member account root actions
    DEnable AWS Config to detect and alert when accounts leave

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  2. Question 2Design Solutions for Organizational Complexity

    A company uses AWS Organizations. They want to allow member accounts to request support cases but restrict the support plan upgrade. Which SCP correctly enforces this?

    ADeny support:CreateCase
    BDeny support:UpdateSupport (premium support plan changes) while allowing support:CreateCase
    CAllow all support actions only for management account
    DUse IAM policies in each account to restrict support plan changes

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  3. Question 3Design Solutions for Organizational Complexity

    A financial services company uses AWS Organizations with multiple OUs. Developers must be prevented from launching large, expensive instance types in dev accounts. How should this be enforced?

    AIAM policies on individual developer users in each account
    BSCPs at the OU level denying launch of specific instance types
    CAWS Config rules with auto-remediation in each account
    DAWS Budgets alerts per developer

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  4. Question 4Design Solutions for Organizational Complexity

    A company uses AWS Organizations and wants to standardize the 'CostCenter' and 'Project' tags across all member accounts. Which AWS Organizations feature enforces tag standardization?

    AService Control Policies (SCPs)
    BAWS Config managed rules
    CAWS Organizations Tag Policies
    DAWS Budgets

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  5. Question 5Design Solutions for Organizational Complexity

    A large enterprise has 50 AWS accounts managed under AWS Organizations. The security team needs to prevent any account from disabling AWS CloudTrail logs. What is the MOST efficient approach?

    AApply an IAM policy in each account denying cloudtrail:StopLogging
    BAttach a Service Control Policy (SCP) at the root or OU level denying cloudtrail:StopLogging
    CEnable AWS Config rule cloudtrail-enabled in each account
    DUse AWS Security Hub to detect and auto-remediate CloudTrail disabling

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  6. Question 6Design Solutions for Organizational Complexity

    A company wants to centralize billing and apply volume discounts across its 30 AWS accounts. Which feature of AWS Organizations enables this?

    AConsolidated billing with linked accounts
    BAWS Cost Explorer multi-account view
    CAWS Budgets cross-account alerts
    DAWS Savings Plans at the management account level

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  7. Question 7Design Solutions for Organizational Complexity

    A global company uses AWS Organizations with multiple OUs for Production, Development, and Sandbox environments. Development accounts need internet access but Production accounts must only access approved AWS services. How should this be designed?

    AApply restrictive SCPs to the Production OU allowing only approved AWS services; apply permissive SCPs to the Development OU
    BUse IAM policies in each Production account to restrict services
    CConfigure VPC security groups to block non-approved service endpoints in Production
    DEnable AWS Shield Advanced only in Production accounts

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  8. Question 8Design Solutions for Organizational Complexity

    A company is planning a multi-account AWS structure and wants to prevent accidental deletion of all AWS accounts in the organization. Which control helps prevent this?

    AEnable MFA on the management account root user and apply an SCP denying organizations:RemoveAccountFromOrganization at the root
    BEnable AWS Backup for all account configurations
    CUse AWS Config to detect and alert on account deletion
    DApply resource-based policies to all accounts

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  9. Question 9Design Solutions for Organizational Complexity

    An organization is consolidating its AWS accounts under Organizations. Some legacy accounts have conflicting CIDR ranges in their VPCs. What is the BEST way to enable communication while avoiding CIDR conflicts?

    ARe-IP all legacy VPCs to use non-overlapping CIDRs
    BUse AWS Transit Gateway with private NAT and custom route tables to translate overlapping CIDRs
    CCreate VPC peering between all accounts
    DUse VPN tunnels with NAT devices on-premises

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  10. Question 10Design Solutions for Organizational Complexity

    A company wants to implement automated cost anomaly detection across all accounts in AWS Organizations. Which service provides this natively?

    AAWS Budgets with cost alerts per account
    BAWS Cost Anomaly Detection with an AWS Organization monitor
    CAWS Cost Explorer with multi-account filtering
    DAmazon CloudWatch with custom billing metrics

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  11. Question 11Design Solutions for Organizational Complexity

    A company is setting up AWS Organizations and needs to ensure that production accounts cannot be accidentally shut down or have critical resources deleted. Which combination of controls is MOST comprehensive?

    AIAM policies in each account with deny on critical actions
    BSCPs at the Production OU level denying ec2:TerminateInstances, rds:DeleteDBInstance, and s3:DeleteBucket on tagged production resources; enable AWS Backup with deletion protection
    CCloudWatch Alarms for all deletion events
    DEnable versioning on all S3 buckets only

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  12. Question 12Design Solutions for Organizational Complexity

    A company has both AWS Organizations member accounts and standalone AWS accounts. They need to apply consistent security policies. What is the MOST efficient approach?

    AApply IAM policies individually in each account
    BInvite standalone accounts to join the organization, then apply SCPs at the OU level
    CUse CloudFormation StackSets for all accounts regardless of organization membership
    DApply policies only to organization member accounts

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  13. Question 13Design Solutions for Organizational Complexity

    A company uses AWS Organizations. They want to prevent member accounts from purchasing Reserved Instances or Savings Plans. Which control achieves this?

    ARemove billing permissions from member account root users
    BSCP denying ec2:PurchaseReservedInstancesOffering, ec2:ModifyReservedInstances, and aws-portal:ModifyBilling
    CEnable consolidated billing with RI sharing disabled
    DSet Budget alerts for RI purchases

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  14. Question 14Design Solutions for Organizational Complexity

    A company with a multi-account AWS Organization wants to implement centralized patch compliance reporting. Patch status from all accounts should be visible in one dashboard. What is the MOST automated approach?

    ACheck each account's Systems Manager Patch Manager console individually
    BUse Systems Manager Explorer with multi-account/multi-region setup via Organizations to aggregate patch compliance data into a central dashboard
    CExport patch data to S3 from each account and query with Athena
    DUse AWS Config rules for patch compliance across accounts

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  15. Question 15Design Solutions for Organizational Complexity

    A company uses AWS Organizations and wants all accounts to automatically inherit DNS resolution from a centralized Route 53 configuration. What architecture implements this?

    APublic Route 53 hosted zones in each account
    BCentralized Route 53 Resolver with shared inbound/outbound endpoints via RAM; resolver rules shared to all accounts via RAM; VPCs in all accounts associated with the central private hosted zones
    CPublic DNS with Route 53
    DEC2 DNS servers in each account

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  16. Question 16Design Solutions for Organizational Complexity

    An organization runs AWS Organizations with 80 accounts. They want automatic incident tickets when GuardDuty detects high-severity findings across any account. What is the most efficient implementation?

    ACheck GuardDuty console in each account daily
    BDesignate a GuardDuty delegated administrator; configure EventBridge in the admin account to match HIGH severity GuardDuty findings from all accounts; trigger Lambda to create ServiceNow/Jira tickets via API
    CEnable GuardDuty email notifications in each account
    DUse AWS Health for GuardDuty notifications

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  17. Question 17Design Solutions for Organizational Complexity

    A company with a multi-account Organization needs to share a central Secrets Manager secret (e.g., RDS master password) with specific member accounts. What is the correct approach?

    AReplicate the secret to each account manually
    BUse AWS Resource Access Manager (RAM) to share the Secrets Manager secret ARN; update the secret resource policy to allow access from the target accounts
    CExport the secret as an environment variable to each account
    DUse cross-account IAM roles with hardcoded secret values

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  18. Question 18Continuous Improvement for Existing Solutions

    A company uses AWS Organizations and wants to ensure that costs are controlled per business unit without restricting innovation. What budget control mechanism is MOST appropriate?

    ASet a hard limit preventing any new AWS resource creation above budget
    BUse AWS Budgets with budget actions: alert at 80% of budget; at 100%, send SNS notification and apply an SCP temporarily restricting new resource creation for that account
    CGive each BU a fixed dollar amount and remove all controls
    DReview costs monthly and manually adjust budgets

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz
  19. Question 19Design Solutions for Organizational Complexity

    An organization has a complex account structure with 8 OUs. A new compliance requirement needs to be applied to 3 specific OUs but not the root. An SCP must allow only FIPS-compliant TLS connections. What approach minimizes management overhead?

    AApply the SCP to all 3 OUs individually
    BMove all 3 OUs under a new parent OU and apply the SCP once to the parent OU
    CApply the SCP to the root and create exceptions for the other 5 OUs
    DCreate individual IAM policies in each account within the 3 OUs

    Answer hidden for practice.

    Use the interactive quiz to reveal the correct answer and explanation.

    Start SAP-C02 Quiz

Key Organizations Concepts for SAP-C02

organizationsorganizationouscpservice control policydelegated administratormulti-accountconsolidated billing

SAP-C02 Organizations Exam Tips

AWS Organizations questions in SAP-C02 are typically scenario-based. Focus on enterprise-scale multi-account architecture, governance, and modernization strategies. Priority concepts: organizations, organization, ou, scp, service control policy, delegated administrator.

What SAP-C02 Expects

  • Anchor your answer in prefer future-proof designs that support organizational complexity and migration realities.
  • Organizations scenarios for SAP-C02 are frequently mapped to Domain 1 (26%), Domain 3 (25%), so read the objective carefully before picking controls or architecture.
  • Expect multi-topic scenarios where Organizations interacts with IAM, networking, storage, or observability patterns rather than appearing as an isolated question.
  • When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Professional) and vendor best practices.

High-Value Organizations Concepts

  • Know the core Organizations building blocks cold: organizations, organization, ou, scp.
  • Review the edge-case features and limits for service control policy, delegated administrator; these details are commonly used to differentiate answer choices.
  • Practice service-integration reasoning: how Organizations pairs with Control Tower, IAM, Cost Optimization in real deployment patterns.
  • For SAP-C02, explain why the chosen Organizations design meets reliability, security, and cost expectations better than the alternatives.

Common SAP-C02 Traps

  • Watch for answers that work for a single account but fail at organizational scale.
  • Questions in Design Solutions for Organizational Complexity often include distractors that look correct for Organizations but violate least-privilege, durability, or availability requirements.
  • Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
  • If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.

Fast Review Checklist

  • Can you compare at least two Organizations implementation paths and justify which one best fits the scenario?
  • Can you map the chosen answer back to Design Solutions for Organizational Complexity (26%) outcomes for SAP-C02?
  • Can you explain security and access boundaries for Organizations without relying on default-open assumptions?
  • Can you describe how Organizations integrates with Control Tower and IAM during failure, scaling, and monitoring events?

Exam Domains Covering Organizations

Related Resources

More SAP-C02 Study Resources