SAP-C02 - Design Solutions for Organizational Complexity (26% of the exam) - Section 1.4

Design a multi-account environment with AWS Organizations and AWS Control Tower, using service control policies, organisational units and centralised logging for governance.

Design a multi-account landing zone using AWS Organizations and AWS Control Tower, applying service control policies at the organisational unit level to enforce guardrails and aggregating logs to a centralised logging account. Recognise how account vending, mandatory controls, and detective controls together provide governance at scale.

AWS OrganizationsAWS Control TowerService control policiesCentralised logging

Practice question for this objective

Free sampleDesign Solutions for Organizational Complexityhard

An enterprise runs an AWS Control Tower landing zone with workload accounts grouped under a Production organisational unit. A new policy requires that every account in that organisational unit must block public access on all Amazon S3 buckets, and the security team must also be alerted whenever an account drifts from this expectation. The platform team wants to satisfy both the hard block and the ongoing visibility using native AWS Control Tower controls applied at the organisational unit, rather than writing and patching its own automation in each account. Which TWO controls should the team enable on the Production organisational unit? (Select TWO.)

AEnable an AWS Control Tower preventive control, implemented as a service control policy, that denies the S3 public-access configuration actions across every account in the Production organisational unit. Correct
BEnable an AWS Control Tower detective control, implemented as an AWS Config rule, that flags any account in the Production organisational unit whose buckets drift away from the blocked-public-access expectation. Correct
CAttach an IAM permissions boundary to every role inside each Production account that caps the maximum permissions so that the S3 public-access actions can never be granted to any application principal.
DWrite a custom AWS Lambda remediation function in each account, triggered on an Amazon EventBridge schedule, that scans the buckets nightly and resets any that have public access enabled.
EEnable Amazon Macie in every Production account so that it discovers buckets with public access and classifies the sensitive data they hold for the security team to review.

Pair a Control Tower preventive control (SCP) with a detective control (Config rule) on an organisational unit to both block and continuously monitor a configuration. AWS Control Tower expresses governance as controls scoped to organisational units. A preventive control is realised as a service control policy that denies the disallowed actions before they can run, giving the hard block, while a detective control is realised as a managed AWS Config rule that continuously evaluates accounts and reports drift, giving the ongoing visibility. Using both managed controls on the organisational unit meets the requirement without per-account custom automation, which permissions boundaries, custom Lambda scanners and Macie cannot provide.

Why A is correct: A Control Tower preventive control is delivered as an SCP attached to the organisational unit, so it stops the disallowed S3 public-access actions outright in every account, satisfying the hard block requirement centrally.

Why B is correct: A Control Tower detective control runs as a managed Config rule across the organisational unit, continuously evaluating accounts and raising non-compliance so the security team gains the ongoing drift visibility the policy demands.

Why C is wrong: Permissions boundaries must be attached per role inside each account and a local administrator can create a role without one, so this is neither a Control Tower control nor a reliable organisational-unit-wide block.

Why D is wrong: A per-account Lambda scanner is exactly the self-built automation the team wants to avoid, it only remediates after the fact on a schedule, and it is not a managed Control Tower control.

Why E is wrong: Macie discovers and classifies sensitive data and reports public buckets, but it neither prevents the public-access configuration nor is it a Control Tower organisational-unit control for enforcing this expectation.

See more SAP-C02 practice questions, answers explained.

Exam traps in Design Solutions for Organizational Complexity

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAP-C02 bank for this domain.

Create the organisation manually with AWS Organizations, then build CloudFormation StackSets and custom Lambda functions to provision each new account, apply baseline policies, and wire up centralised logging by hand.
Why it is wrong: Hand-built StackSets and Lambda give full control, but the small team then owns provisioning, drift detection and patching of all that automation, which is exactly the operational burden the group wants to avoid.
Remove the AWS managed FullAWSAccess policy and attach only narrow allow service control policies that enumerate each permitted action, since a deny-list model requires explicit allow entries for everything that should remain usable.
Why it is wrong: Enumerating every permitted action describes an allow-list model and is the opposite of a deny list, which keeps FullAWSAccess in place and layers targeted denies on top, so this approach is both incorrect and unmanageable at scale.
Run all production workloads, security tooling and centralised logging directly inside the management account so that a single highly privileged account governs the entire organisation from one place.
Why it is wrong: Concentrating workloads, security tooling and logging in the management account maximises its blast radius and contradicts the requirement to keep that account out of daily operations, so it is the opposite of sound multi-account design.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.