Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 62: Organization Backup Policies Delegated Admin

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 7 · question 2 of 10

Organizational Complexitymedium

A company has 60 AWS accounts in an AWS Organization. The security team wants every account to take daily backups of all tagged Amazon RDS databases and EBS volumes and keep them for 35 days. Accounts in the Production OU must keep backups for one year instead. New accounts must be protected automatically when they are created. The backup team must monitor backup, copy and restore jobs across all accounts, but the company wants to keep that team out of the management account.

Which solution meets these requirements with the LEAST ongoing effort?

Select one answer
Show answer and explanation

Answer:

  • A. Enable AWS Backup cross-account management, attach backup policies with the same plan name at the root (35 days) and on the Production OU (one year), and register a delegated administrator

AWS Backup integrates with AWS Organizations so that you can *"create a backup policy and apply it to selected accounts that are part of your organization"*. A policy attached to the root gives every account a corresponding backup plan, and AWS gives the exact pattern in this scenario: a second policy attached to an OU *"overrides the lifecycle value"*, and the two policies are merged into the effective plan for accounts in that OU. New accounts inherit the policy automatically. With delegated administrator accounts, *"assigned users in a registered member account [can] perform most AWS Backup administrative tasks"*, including cross-account monitoring, which *"minimizes the number of users with access to the management account"* (option A). Each account needs at least one backup vault and an IAM role for the plans to work.

- B is wrong because AWS RAM does not share RDS databases or EBS volumes for backup purposes, and a single plan in the management account cannot back up other accounts' resources. - C is wrong because an SCP that blocks deletions does not create any backups, and it leaves every account team responsible for building and maintaining its own plans. - D is wrong because AWS Config can detect missing backups but does not create them, and manual weekly remediation across 60 accounts is high ongoing effort.

Reference: Managing AWS Backup resources across multiple AWS accounts

Practice Test 7 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.