Design Solutions for Organizational Complexity Study Guide — SAP-C02

Design Solutions for Organizational Complexity – SAP-C02 Study Guide

This domain accounts for 26% of the exam and covers designing across many accounts, networks, and teams — the "enterprise scale" material that distinguishes Professional from Associate. Expect multi-account governance, cross-account and hybrid networking, centralized security/logging, and organization-wide cost strategies. The exam tests whether you reach for org-level guardrails (SCPs, Control Tower, Transit Gateway) instead of per-account hacks.

Multi-Account Governance

• AWS Organizations — group accounts into OUs; apply Service Control Policies (SCPs) as guardrails that set the maximum permissions for member accounts. SCPs cannot be overridden by account IAM — use them to restrict Regions, deny disabling security services, or enforce data residency.
• AWS Control Tower — sets up and governs a secure multi-account landing zone: Account Factory provisions standardized, guarded accounts; centralized logging and guardrails come built in.
• Delegated administrator — register a security account to run org-wide services (GuardDuty, Security Hub) instead of the management account.

SCPs are preventive, not detective — they're the answer when a control must hold regardless of account-level IAM.