Centralized billing and service governance for LOB accounts with Organizations and SCPs

SAP-C02 By islever Editorial Last updated

Design a multi-account AWS environment.

Short answer

BD Use one Organizations organization for consolidated billing and per-account breakdown, and apply an SCP for approved services without losing LOB admin.

Question

A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements: • Produce a single AWS invoice for all of the AWS accounts used by its LOBs. • The costs for each LOB account should be broken out on the invoice. • Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy. • Each LOB account should be delegated full administrator permissions, regardless of the governance policy. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
  1. Use AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
  2. Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization. Correct Answer
  3. Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
  4. Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts. Correct Answer
  5. Enable consolidated billing in the parent account's billing console and link the LOB accounts.

Key Takeaways

AWS Organizations delivers consolidated billing and per-account cost visibility by default; an SCP restricts which services can be used but does not revoke administrator IAM permissions, so LOB admins keep full control within allowed services.

A parent with multiple LOB accounts needs a single consolidated invoice with per-account cost breakdown, service restrictions per governance, and full LOB administrator autonomy. A single AWS Organizations organization provides consolidated billing with per-account visibility, and an SCP restricts approved services without removing administrator permissions.

Common mistake: Thinking an SCP conflicts with 'full administrator' (Option E supporters) — SCPs constrain the service surface, not the administrator role, so delegated admins remain fully administrative for approved services.

Expert Analysis

Why the Answer Is Correct

Option B creates a single organization and invites each LOB account, enabling consolidated billing and per-account cost breakout. Option D applies an SCP allowing only approved services to the LOB accounts, enforcing governance without taking away administrator privileges (SCPs limit the API surface, not IAM admin rights).

Why the Other Options Are Wrong

Option A creates multiple organizations, which fragments consolidated billing. Option C (service quotas) is account-scoped and weaker than org-level SCP governance. Option E (enable consolidated billing) is redundant because consolidated billing is automatic once an organization exists.

Community Comment Notes

7f6aef3 (likes 14) notes consolidated billing is default in an organization and that an SCP applies per LOB account. chelbsik argues BE, claiming D conflicts with full admin, but SCPs do not strip admin rights. The vote is BD (57) over BE (38).

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

This link opens the official vendor documentation in a new tab.

Community Votes

BD
60%
BE
40%

60% of anonymous learners picked answer BD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. 7f6aef3 👍 14
    E: Is wrong --> Consolidated billing is already enabled by default when you create an organization B: obvious D: since there are no OUs, I assume that the SCP applies to each LOB account
  2. chelbsik 👍 8
    I choose BE D conficts with the last requirement
  3. teo2157 👍 4
    We have to read carefully the question, it says "Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.", Organizations itself provide that ability but the question is not saying anything about to apply SCPs immediatelly to the OUs but just to have that ability. So for me D is discarded due to that.
  4. VerRi 👍 4
    It should be BE. D just clearly broke the requirement of "each LOB account should be delegated full administrator permissions, regardless of the governance policy.".
  5. Keval12345 👍 3
    I think there should bbe choose 3 options here. BDE
Show 21 more comments
  1. bjexamprep 👍 2
    The number of answers can not satisfy the question objectives. “Produce a single AWS invoice for all of the AWS accounts used by its LOBs.” B “The costs for each LOB account should be broken out on the invoice.” E is trying to address this requirement, but has flaw. “Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.” D, but the policy should be applied to OU instead of Account. “Each LOB account should be delegated full administrator permissions, regardless of the governance policy.” NO answer is addressing this requirement.
  2. 981809e 👍 2
    Why not B and E? SCP will restrict the other accounts which contradicts the last requirement. We would have to go B and E for that reason
  3. kejam 👍 2
    Answer BD: Changed my answer because of this text in A: "Then invite each LOB account to the appropriate organization."
  4. zolthar_z 👍 2
    For SAP 01 version D and E were in the same option, so the answer is B - D+E
  5. a54b16f 👍 2
    Can't be A, unless it changes to OU
  6. 0b43291 👍 1
    B. Use AWS Organizations to create a single organization in the parent account and invite each LOB's AWS account to join. This allows: - Producing a single invoice for all accounts (consolidated billing). - Breaking out costs for each LOB account. - Delegating full administrator permissions to LOB accounts (through SCPs). D. Create an SCP that allows only approved services and features based on the governance policy, and apply it to the LOB accounts. SCPs in AWS Organizations define rules for what services and resources can be used in member accounts. This restricts available services and features for LOB accounts while allowing full administrator permissions within defined boundaries.
  7. PSPaul 👍 1
    This is a very interesting question. While the answer appears to be B + D, the solution could be further enhanced by including option E. However, given the question's emphasis on restricting services within each Line of Business (LOB), B + D likely represents the most suitable choice.
  8. pk0619 👍 1
    If we choose E are we saying that we only enable Consolidated billing feature of Organization and not all features. Because then we cannot even use SCP ? D is not entirely correct as well - SCP are there to Deny and set perimeter, instead of allowing
  9. kejam 👍 1
    Answer AD: A: Creates a separate organization (unit) for each LOB, useful for LOB billing. D: SCPs to limit only approved services as defined by the governance policy.
  10. djangoUnchained 👍 1
    Could it be A, C? Service quotas is a terrible way of restricting features but it's the only one that satisfies the last 2 requirements.
  11. PSPaul 👍 1
    It should be B and D But it's not really true. To have B + D +E together is perfect To response this question BD is would be ok
  12. trungtd 👍 1
    B D because Consolidated billing is already enabled by default when you create an organization
  13. thotwielder 👍 1
    The question asks for billing at LOB level not at a company level. So A, not B.
  14. naylinu 👍 1
    It should chose 3 ......... A + E . And D is require for governance
  15. igor12ghsj577 👍 1
    I think something is missing in this question related to tags.
  16. tgv 👍 1
    B D D is required for governance
  17. alexis123456 👍 4
    correct answer is B and D
  18. TheCloudGuruu 👍 3
    B and E
  19. seetpt 👍 2
    BE for me
  20. career360guru 👍 2
    B and D
  21. duriselvan 👍 1
    D,E ANS

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide