SAP-C02 Practice Question 82: Config Aggregator Organization Compliance

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 9 · question 2 of 10

Organizational Complexityeasy

AWS Config is enabled in all 50 accounts of an AWS Organization, in three Regions each. The compliance team wants a single, read-only view of the compliance status of Config rules and the recorded resource configurations across all accounts and Regions, and they want it at no additional cost. The accounts' own teams will continue to manage their own rules.

Which solution meets these requirements?

Show answer and explanation

Answer:

C. Create an AWS Config aggregator in a central account that uses the organization as its source

*"An aggregator is an AWS Config resource type that collects AWS Config configuration and compliance data"* from multiple accounts and Regions, including *"an organization in AWS Organizations and all the accounts in that organization which have AWS Config enabled."* Its use cases include compliance monitoring across the organization. When the source is an organization, authorization from each account is not required, and *"using aggregators does not incur any additional costs"* (option C).

- A is wrong because reviewing 150 account and Region combinations one by one does not provide a single view and cannot be kept current. - B is wrong because weekly snapshots are stale, they are not an interactive view of compliance state, and they add S3 and processing work. - D is wrong because aggregators give a *read-only view*: *"you cannot deploy rules through an aggregator."* Rules are deployed by other means, such as conformance packs or organization rules.

Reference: Multi-Account Multi-Region Data Aggregation for AWS Config

Practice Test 9 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.