Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Amazon SAP-C02 Exam - Topic 1 Question 68 Discussion

A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment.A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution also needs to integrate with the existing on-premises Active Directory Federation Services (AD FS) server.Which solution meets these requirements with the LEAST amount of operational overhead?
B) Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWSConfig for areas that require additions. Add OUS as necessary. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server.
A) Create an organization in AWS Organizations. Create a single SCP for least privilege access across all accounts. Create a single OU for all accounts.Configure an IAM identity provider for federation with the on-premises AD FS server. Configure a central logging account with a defined process for loggenerating services to send log events to the central account. Enable AWS Config in the central account with conformance packs for all accounts.
C) Create an organization in AWS Organizations. Create SCPs for least privilege access. Create an OU structure, and use it to group AWS accounts. ConnectAWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server. Configure a central logging account with a defined process for loggenerating services to send log events to the central account. Enable AWS Config in the central account with aggregators and conformance packs.
D) Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWSConfig for areas that require additions. Configure an IAM identity provider for federation with the on-premises AD FS server.

Amazon SAP-C02 Exam - Topic 1 Question 68 Discussion

Actual exam question for Amazon's SAP-C02 exam
Question #: 68
Topic #: 1
[All SAP-C02 Questions]

A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment.

A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution also needs to integrate with the existing on-premises Active Directory Federation Services (AD FS) server.

Which solution meets these requirements with the LEAST amount of operational overhead?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Lachelle at May 07, 2026, 07:36 PM

Limited Time Offer

25%

Off

Get Premium SAP-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Filiberto
1 day ago
D might be too complex for some teams.
upvoted 0 times
...
Felix
7 days ago
I feel like C covers all bases without too much hassle.
upvoted 0 times
...
Halina
12 days ago
A's central logging is crucial for audits.
upvoted 0 times
...
Gilbert
17 days ago
B's guardrails are a big plus for compliance.
upvoted 0 times
...
Stephane
22 days ago
D is appealing too, but I worry about the overhead.
upvoted 0 times
...
Justine
27 days ago
C has a good balance of security and flexibility.
upvoted 0 times
...
Orville
1 month ago
I agree, but A seems more straightforward for logging.
upvoted 0 times
...
Maxima
1 month ago
I think option B is the best. Control Tower simplifies management.
upvoted 0 times
...
Clay
1 month ago
Wait, can AWS Control Tower really handle all those compliance needs?
upvoted 0 times
...
Vince
2 months ago
I agree, B has the right mix of flexibility and control.
upvoted 0 times
...
Chantell
2 months ago
Not sure about D, seems like it might miss some compliance checks.
upvoted 0 times
...
Audry
2 months ago
I think A is better for centralized logging!
upvoted 0 times
...
Kerry
2 months ago
Option B seems solid with Control Tower for governance.
upvoted 0 times
...
Onita
2 months ago
I’m leaning towards option A because it mentions a central logging account, which seems important for compliance, but I’m not entirely sure about the SCP setup.
upvoted 0 times
...
Eric
4 months ago
I practiced a similar question about IAM identity providers, and I feel like options B and D could be close, but I can't recall the specifics on the logging requirements.
upvoted 0 times
...
My
4 months ago
I think enabling AWS Control Tower might be the way to go since it provides built-in guardrails, but I need to double-check how it integrates with AD FS.
upvoted 0 times
...
Beata
4 months ago
I remember studying about AWS Organizations and how it helps manage multiple accounts, but I'm not sure which option minimizes operational overhead the best.
upvoted 0 times
...

Save Cancel