A company operates hundreds of AWS accounts under AWS Organizations. The security team needs a single, centralized view of all API activity across the organization for auditing and incident response. They want to ensure that logs from all accounts, including future accounts, are automatically delivered to a central location. What should the security team do?

Configure AWS Config aggregator in the management account to collect configuration history from all accounts.

Set up Amazon GuardDuty in each account and send findings to a central Security Hub.

Create an IAM role in each account that grants the security team access to read the local CloudTrail logs.

Enable AWS CloudTrail in the management account and create an organization trail that delivers logs to a central S3 bucket.

Which statement correctly describes how service control policies (SCPs) affect permissions in AWS Organizations?

SCPs apply only to the management account

SCPs act as a permission boundary for all IAM principals in the affected accounts

SCPs are used to configure cross-account role trust policies

SCPs grant permissions to IAM principals in the affected accounts

AWSCertified Solutions Architect - Professional

Domain 1Objective 4

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 6)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

10concepts

10 Concepts in This Objective

Multi-account strategy
AWS Organizations
Service control policies (SCPs)
Account design patterns
Networking across accounts
Identity and access management (IAM) across accounts
Centralized logging and monitoring
Cost management and billing
Compliance and governance
Migration and account consolidation

Questions 26–30

26foundation · easy
A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project across all accounts. Which feature should be used to categorize resources by project?
Select an answer first
27application · medium
A company operates hundreds of AWS accounts under AWS Organizations. The security team needs a single, centralized view of all API activity across the organization for auditing and incident response. They want to ensure that logs from all accounts, including future accounts, are automatically delivered to a central location. What should the security team do?
Select an answer first
28foundation · easy
In a multi-account AWS environment, which account design pattern is commonly used to host centrally managed services such as Active Directory, DNS, and centralized logging that are shared across multiple accounts?
Select an answer first
29foundation · easy
Which statement correctly describes how service control policies (SCPs) affect permissions in AWS Organizations?
Select an answer first
30foundation · easy
A company is consolidating multiple AWS accounts into a single organization. Which AWS service should be used to manage the accounts and move them into the organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 6)

Questions 26–30

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project across all accounts. Which feature should be used to categorize resources by project?

In a multi-account AWS environment, which account design pattern is commonly used to host centrally managed services such as Active Directory, DNS, and centralized logging that are shared across multiple accounts?

Which statement correctly describes how service control policies (SCPs) affect permissions in AWS Organizations?

A company is consolidating multiple AWS accounts into a single organization. Which AWS service should be used to manage the accounts and move them into the organization?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity