Centralized billing and service governance for LOB accounts with Organizations and SCPs

Design a multi-account AWS environment.

Answer Correct answer: B, D — Use one Organizations organization for consolidated billing and per-account breakdown, and apply an SCP for approved services without losing LOB admin.

A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements: • Produce a single AWS invoice for all of the AWS accounts used by its LOBs. • The costs for each LOB account should be broken out on the invoice. • Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy. • Each LOB account should be delegated full administrator permissions, regardless of the governance policy. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

Use AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization. Correct Answer
Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts. Correct Answer
Enable consolidated billing in the parent account's billing console and link the LOB accounts.

Community Votes

60%

40%

60% of anonymous learners picked answer BD. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

AWS Organizations delivers consolidated billing and per-account cost visibility by default; an SCP restricts which services can be used but does not revoke administrator IAM permissions, so LOB admins keep full control within allowed services.

A parent with multiple LOB accounts needs a single consolidated invoice with per-account cost breakdown, service restrictions per governance, and full LOB administrator autonomy. A single AWS Organizations organization provides consolidated billing with per-account visibility, and an SCP restricts approved services without removing administrator permissions.

Thinking an SCP conflicts with 'full administrator' (Option E supporters) — SCPs constrain the service surface, not the administrator role, so delegated admins remain fully administrative for approved services.

Community Discussion (26 comments)

7f6aef3 👍 14 Selected: BD

E: Is wrong --> Consolidated billing is already enabled by default when you create an organization B: obvious D: since there are no OUs, I assume that the SCP applies to each LOB account

chelbsik 👍 8 Selected: BE

I choose BE D conficts with the last requirement

PSPaul 👍 1 Selected: BD

This is a very interesting question. While the answer appears to be B + D, the solution could be further enhanced by including option E. However, given the question's emphasis on restricting services within each Line of Business (LOB), B + D likely represents the most suitable choice.

PSPaul 👍 1 Selected: BD

It should be B and D But it's not really true. To have B + D +E together is perfect To response this question BD is would be ok

pk0619 👍 1 Selected: AD

If we choose E are we saying that we only enable Consolidated billing feature of Organization and not all features. Because then we cannot even use SCP ? D is not entirely correct as well - SCP are there to Deny and set perimeter, instead of allowing

0b43291 👍 1 Selected: BD

B. Use AWS Organizations to create a single organization in the parent account and invite each LOB's AWS account to join. This allows: - Producing a single invoice for all accounts (consolidated billing). - Breaking out costs for each LOB account. - Delegating full administrator permissions to LOB accounts (through SCPs). D. Create an SCP that allows only approved services and features based on the governance policy, and apply it to the LOB accounts. SCPs in AWS Organizations define rules for what services and resources can be used in member accounts. This restricts available services and features for LOB accounts while allowing full administrator permissions within defined boundaries.

tgv 👍 1 Selected: BD

B D D is required for governance

zolthar_z 👍 2

For SAP 01 version D and E were in the same option, so the answer is B - D+E

trungtd 👍 1 Selected: BD

B D because Consolidated billing is already enabled by default when you create an organization

naylinu 👍 1

It should chose 3 ......... A + E . And D is require for governance

teo2157 👍 4 Selected: BE

We have to read carefully the question, it says "Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.", Organizations itself provide that ability but the question is not saying anything about to apply SCPs immediatelly to the OUs but just to have that ability. So for me D is discarded due to that.

seetpt 👍 2 Selected: BE

BE for me

bjexamprep 👍 2

The number of answers can not satisfy the question objectives. “Produce a single AWS invoice for all of the AWS accounts used by its LOBs.” B “The costs for each LOB account should be broken out on the invoice.” E is trying to address this requirement, but has flaw. “Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.” D, but the policy should be applied to OU instead of Account. “Each LOB account should be delegated full administrator permissions, regardless of the governance policy.” NO answer is addressing this requirement.

Keval12345 👍 3 Selected: BD

I think there should bbe choose 3 options here. BDE

VerRi 👍 4 Selected: BE

It should be BE. D just clearly broke the requirement of "each LOB account should be delegated full administrator permissions, regardless of the governance policy.".

djangoUnchained 👍 1

Could it be A, C? Service quotas is a terrible way of restricting features but it's the only one that satisfies the last 2 requirements.

career360guru 👍 2 Selected: BD

B and D

thotwielder 👍 1 Selected: AD

The question asks for billing at LOB level not at a company level. So A, not B.

a54b16f 👍 2 Selected: BD

Can't be A, unless it changes to OU

igor12ghsj577 👍 1

I think something is missing in this question related to tags.

TheCloudGuruu 👍 3 Selected: BE

B and E

981809e 👍 2

Why not B and E? SCP will restrict the other accounts which contradicts the last requirement. We would have to go B and E for that reason

kejam 👍 2 Selected: BD

Answer BD: Changed my answer because of this text in A: "Then invite each LOB account to the appropriate organization."

kejam 👍 1 Selected: AD

Answer AD: A: Creates a separate organization (unit) for each LOB, useful for LOB billing. D: SCPs to limit only approved services as defined by the governance policy.

alexis123456 👍 4 Selected: BD

correct answer is B and D

duriselvan 👍 1

D,E ANS

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option B creates a single organization and invites each LOB account, enabling consolidated billing and per-account cost breakout. Option D applies an SCP allowing only approved services to the LOB accounts, enforcing governance without taking away administrator privileges (SCPs limit the API surface, not IAM admin rights).

Why the Other Options Are Wrong

Option A creates multiple organizations, which fragments consolidated billing. Option C (service quotas) is account-scoped and weaker than org-level SCP governance. Option E (enable consolidated billing) is redundant because consolidated billing is automatic once an organization exists.

Community Comment Notes

7f6aef3 (likes 14) notes consolidated billing is default in an organization and that an SCP applies per LOB account. chelbsik argues BE, claiming D conflicts with full admin, but SCPs do not strip admin rights. The vote is BD (57) over BE (38).

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

Related Analysis

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide