A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any IAM principal from creating IAM users in any account in the organization. Which solution should the security team implement?

Create an SCP that denies the iam:CreateUser action and attach it to the root OU.

Create an IAM policy that denies the iam:CreateUser action and attach it to all IAM users.

Enable multi-factor authentication (MFA) for all IAM users in the organization.

Use AWS Config rule iam-user-no-policies-check to detect and alert on IAM users with policies.

AWSCertified Solutions Architect - Professional

Domain 1Objective 4

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 4)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

10concepts

10 Concepts in This Objective

Multi-account strategy
AWS Organizations
Service control policies (SCPs)
Account design patterns
Networking across accounts
Identity and access management (IAM) across accounts
Centralized logging and monitoring
Cost management and billing
Compliance and governance
Migration and account consolidation

Questions 16–20

16foundation · easy
A company must ensure that no IAM principal in any account can create resources in AWS regions outside of a specific set of approved regions. Which AWS feature can enforce this requirement across all accounts?
Select an answer first
17application · medium
A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any IAM principal from creating IAM users in any account in the organization. Which solution should the security team implement?
Select an answer first
18foundation · easy
Which AWS service can be used to evaluate resource configurations across multiple accounts and detect non-compliant resources, such as an S3 bucket with public access?
Select an answer first
19foundation · easy
When migrating a workload from a standalone AWS account into a multi-account structure, which AWS service can be used to automate the deployment of resources into the target account?
Select an answer first
20foundation · easy
A company wants to receive alerts when spending in a specific AWS account exceeds a predefined threshold. Which AWS service should be used to set up these alerts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 4)

Questions 16–20

A company must ensure that no IAM principal in any account can create resources in AWS regions outside of a specific set of approved regions. Which AWS feature can enforce this requirement across all accounts?

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce a policy that prevents any IAM principal from creating IAM users in any account in the organization. Which solution should the security team implement?

Which AWS service can be used to evaluate resource configurations across multiple accounts and detect non-compliant resources, such as an S3 bucket with public access?

When migrating a workload from a standalone AWS account into a multi-account structure, which AWS service can be used to automate the deployment of resources into the target account?

A company wants to receive alerts when spending in a specific AWS account exceeds a predefined threshold. Which AWS service should be used to set up these alerts?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity