nerdexam
Amazon

SAP-C02 · Question #371

A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account…

The correct answer is B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only. To provide the security team read-only access to all AWS Organization member accounts from their own account, a new IAM role with read-only permissions should be created in each member account, with its trust policy allowing the security team's account to assume it.

Submitted by hassan_iq· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team. How should a solutions architect meet these requirements?

Options

  • AUse the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only
  • BUse the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only
  • CAsk the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole
  • DAsk the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole

How the community answered

(39 responses)
  • A
    5% (2)
  • B
    82% (32)
  • C
    10% (4)
  • D
    3% (1)

Why each option

To provide the security team read-only access to all AWS Organization member accounts from their own account, a new IAM role with read-only permissions should be created in each member account, with its trust policy allowing the security team's account to assume it.

AUse the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only

The `OrganizationAccountAccessRole` is an IAM role, not a policy, so it cannot be used to create a "new IAM policy with read-only" permissions in the way described.

BUse the OrganizationAccountAccessRole IAM role to create a new IAM role with read-onlyCorrect

The `OrganizationAccountAccessRole` can be used by the management account to create a new, specifically read-only IAM role in each member account, which the security team's AWS account can then assume to gain cross-account read-only access while adhering to the principle of least privilege.

CAsk the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole

Calling AWS STS AssumeRole is the action taken by the security team to access the role, but this option does not describe how to *create or configure* a read-only role that the security team should assume.

DAsk the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole

Similar to C, this option describes the *mechanism* for assuming a role but fails to address the crucial step of creating and configuring a read-only role with the appropriate trust policy in the member accounts.

Concept tested: Cross-account access, IAM roles, AWS Organizations, least privilege

Source: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice