SAP-C02 Practice Test 12 — 15 Questions

Question 1

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.. Option C is correct because a service control policy (SCP) can be applied at the organizational unit (OU) or account level to deny all console access unless the `aws:MultiFactorAuthPresent` condition key is `true`. This enforces MFA usage across all member accounts centrally, without requiring per-account IAM policy changes. SCPs are the recommended mechanism for guardrails in AWS Organizations because they cannot be overridden by account administrators.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Enable AWS CloudTrail to log console access without MFA.

Answer

Use AWS Single Sign-On (SSO) with MFA enabled for all users.

Question 2

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

Accepted Answer

Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.. Using CloudFormation stack-level tags with a service control policy (SCP) that requires tags is the correct approach. Option B is incorrect because IAM policies can enforce tags on resources created by CloudFormation. Option C is incorrect because AWS Config can detect but not enforce. Option D is incorrect because CloudFormation does not natively enforce tag propagation without additional mechanisms.

Answer

Create an IAM policy that requires tags on all resources and attach it to all IAM users.

Answer

Configure CloudFormation to reject any stack that does not include tags.

Answer

Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.

Question 3

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Accepted Answer

Share the IPAM pool using AWS Resource Access Manager (RAM).. Option C is correct because AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Answer

Create a PrivateLink endpoint for IPAM.

Answer

Enable VPC sharing in each member account.

Answer

Set up AWS Direct Connect between accounts.

Question 4

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID. Option D is correct because an SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Answer

Create an EC2 launch template with the approved AMI and share it with all accounts

Answer

Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances

Answer

Use AWS Config rules in each account to detect non-compliant instances and send alerts

Question 5

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

Accepted Answer

Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.. Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Answer

Use S3 object-level compression (e.g., gzip) to reduce data volume.

Answer

Create AWS Glue partition indexes on the table.

Answer

Create separate Athena tables for each account and region.

Question 6

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

Accepted Answer

Register the member account as a delegated administrator for CloudTrail in AWS Organizations.. Option A is correct because registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Answer

Create a resource-based policy on the CloudTrail service to allow the member account to create trails.

Answer

Create an IAM role in the management account and grant the developer permission to assume it.

Answer

Attach an SCP to the member account that allows CloudTrail actions.

Question 7

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.. Option C is correct because AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Answer

Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.

Answer

Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.

Answer

Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.

Question 8

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

Accepted Answer

Use AWS Systems Manager Explorer with multi-account management.. AWS Systems Manager Explorer provides a single-pane-of-glass view across multiple AWS accounts and Regions, allowing the operations team to view and modify EC2 Auto Scaling policies centrally. It integrates with Systems Manager Automation runbooks to execute changes, such as updating scaling policies, across all accounts managed via AWS Organizations.

Answer

Use AWS CloudFormation StackSets to deploy the Auto Scaling groups consistently.

Answer

Use AWS Config rules to enforce desired scaling policies.

Answer

Use Amazon CloudWatch cross-account dashboards.

Question 9

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Accepted Answer

Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.. Option A is correct because CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Answer

Use a VPC endpoint and route logs through a central VPC.

Answer

Attach an SCP to allow CloudTrail to write to the central bucket.

Answer

Create an IAM role in each member account and allow the central account to assume it.

Question 10

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Accepted Answer

Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.. Option C is correct because it uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Answer

Use AWS PrivateLink to connect each VPC to the network account.

Answer

Create VPC peering connections between each VPC and the network account.

Answer

Assign new non-overlapping CIDR ranges to each VPC and update all resources.

Question 11

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies iam:CreateAccessKey. Option B is correct because an SCP can deny the CreateAccessKey action across all accounts. Option A is wrong because an IAM policy in each account is not centrally managed. Option C is wrong because AWS Config can detect but not prevent. Option D is wrong because CloudTrail is for logging.

Answer

Enable AWS CloudTrail and set up a metric filter for CreateAccessKey

Answer

Apply an IAM policy to all users in each account that denies iam:CreateAccessKey

Answer

Use AWS Config to detect access key creation and trigger a Lambda to delete the key

Question 12

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Answer

AWS IAM

Answer

AWS Control Tower

Answer

AWS Service Catalog

Question 13

A company is designing a new microservices-based application on AWS. They need to decouple services and ensure asynchronous communication. Which AWS service should they use?

Accepted Answer

Amazon SQS. Amazon SQS is a fully managed message queuing service that enables decoupling of application components. Option A (Amazon SNS) is for pub/sub messaging, Option C (Amazon Kinesis) is for real-time streaming, and Option D (AWS Lambda) is for serverless compute.

Answer

Amazon Kinesis

Answer

AWS Lambda

Answer

Amazon SNS

Question 14

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.. Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Answer

Use AWS Config rules to detect and automatically delete any new users or keys.

Answer

Enable AWS CloudTrail and create a metric filter to alert on these actions.

Answer

Attach an IAM policy to the Administrator role in each account that denies these actions.

Question 15

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct service because it acts as a central hub that can route traffic between multiple VPCs across different accounts, and it supports route tables that can force all inter-VPC traffic through a dedicated inspection VPC (e.g., using a blackhole route or a network appliance). This enables transitive routing without requiring full mesh peering, and it integrates with AWS Resource Access Manager (RAM) for cross-account sharing.

Answer

AWS Direct Connect gateway

Answer

VPC peering with full mesh connectivity

Answer

Elastic Load Balancer