AWS Solutions Architect Professional (SAP-C02) · 26% practice allocation

AWS SAP-C02: Design Solutions for Organizational Complexity Practice Questions

5 free sample questions from the Design Solutions for Organizational Complexity domain, with answers and explanations. The full SAP-C02 bank has 59 questions across 4 domains. Questions are scenario-based and written from the official AWS exam guide.

1.

An organization must delegate administration of a security service (e.g., GuardDuty) to a dedicated security account rather than running it from the management account. Which AWS Organizations capability supports this?

  • A. Delegated administrator for the security service✓ Correct
  • B. Sharing the management account's root credentials
  • C. Creating IAM users in the management account
  • D. A resource-based policy on an S3 bucket
Explanation

AWS Organizations lets you register a delegated administrator account for supported services (like GuardDuty, Security Hub), so a security account manages the service org-wide without using the management account. Sharing root (B) is dangerous, management-account IAM users (C) don't delegate org-wide service admin, and a bucket policy (D) is unrelated.

2.

A company needs a private, dedicated, high-bandwidth network connection between its on-premises datacenter and AWS with consistent latency for large data transfers. Which service should the architect recommend?

  • A. AWS Direct Connect✓ Correct
  • B. A site-to-site VPN over the public internet
  • C. Amazon CloudFront
  • D. AWS Global Accelerator only
Explanation

AWS Direct Connect provides a private, dedicated connection with consistent, predictable bandwidth and latency — ideal for large, steady transfers. A VPN (B) is encrypted but rides the public internet with variable performance, CloudFront (C) is a CDN, and Global Accelerator (D) optimizes internet paths but isn't a private dedicated link.

3.

A security team must aggregate and continuously analyze security findings (from GuardDuty, Inspector, and more) across all accounts in the organization in one place. Which service should the architect recommend?

  • A. AWS Security Hub (with organization aggregation)✓ Correct
  • B. A separate CloudWatch dashboard per account with no aggregation
  • C. Amazon QuickSight only
  • D. AWS Cost Explorer
Explanation

AWS Security Hub aggregates and prioritizes security findings from multiple AWS security services across all accounts, with organization-wide aggregation. Per-account dashboards (B) don't centralize, QuickSight (C) is BI visualization, and Cost Explorer (D) analyzes spend, not security findings.

4.

A company wants to share centrally managed subnets from a networking account with application accounts so teams deploy into a common VPC without managing it. Which capability should the architect use?

  • A. VPC sharing via AWS Resource Access Manager (RAM)✓ Correct
  • B. Copying the VPC into each account
  • C. Public subnets with open security groups
  • D. Peering every account's VPC to the networking VPC
Explanation

AWS RAM enables VPC subnet sharing, letting a central networking account share subnets with other accounts that deploy resources into them — centralized network management. Copying the VPC (B) duplicates management, peering (D) connects separate VPCs rather than sharing one, and open public subnets (C) are insecure.

5.

A company wants new accounts to automatically inherit a baseline set of guardrails and be placed under the correct OU, provisioned in a self-service way by approved teams. Which Control Tower feature provides this?

  • A. AWS Batch
  • B. Account Factory✓ Correct
  • C. Amazon Inspector
  • D. AWS Trusted Advisor
Explanation

Control Tower's Account Factory provisions new accounts with standardized baseline configuration and guardrails, placed into the right OU. Inspector (C) scans for vulnerabilities, Trusted Advisor (D) gives best-practice checks, and Batch (A) runs compute jobs — none provisions governed accounts.

Test yourself across every SAP-C02 domain

The free SAP-C02 practice test mixes about 20 questions weighted like the exam. The full 59-question bank adds instant grading, flashcards and a timed mock exam.

Take the free SAP-C02 practice testPractice the full bank

Study this domain

Design Solutions for Organizational Complexity study guide (SAP-C02) →

Other SAP-C02 domains

← All AWS Solutions Architect Professional study resources