SAP-C02 Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Accepted Answer

It denies all actions if the request is not made over HTTPS.. This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is wrong because it does not enforce MFA. Option C is wrong because it does not block specific services. Option D is wrong because it does not allow all actions; it denies unencrypted requests.

Answer

It denies all actions if the request does not include multi-factor authentication.

Answer

It denies all actions from IP addresses outside the corporate network.

Answer

It allows all actions as long as the request is made over HTTPS.

Question 2

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

Accepted Answer

Apply an SCP to the development account that denies iam:CreateUser.. Option C is correct because an SCP can deny the iam:CreateUser action in the development account. Option A is wrong because IAM policies attached to developers affect their user permissions, but if they have admin privileges, they can bypass. Option B is wrong because IAM groups can be bypassed if users have other permissions. Option D is wrong because CloudTrail only logs, does not prevent.

Answer

Create an IAM group for developers with a policy that denies iam:CreateUser.

Answer

Enable AWS CloudTrail to monitor iam:CreateUser calls.

Answer

Attach an IAM policy to each developer user that denies iam:CreateUser.

Question 3

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Accepted Answer

Attach the VPCs in member accounts to the transit gateway.. Option A is correct because attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.

Answer

Create VPC endpoints for the transit gateway in each VPC.

Answer

Create VPC peering connections between each VPC and the networking VPC.

Question 4

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Accepted Answer

Place the Lambda function in a VPC with access to the RDS instance. Option A is correct because placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Answer

Store database credentials in the Lambda function code

Answer

Use a public IP address for the RDS instance

Question 5

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.. Option C is correct because enabling S3 Block Public Access at the account level prevents any public access to S3 buckets, and using a service control policy (SCP) to deny actions that would disable this setting ensures it cannot be overridden by any account in the organization. This enforces encryption indirectly by ensuring that all buckets are private, but the primary requirement is encryption; however, the question asks for two actions, and C combined with E provides a complete solution. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable encryption, ensuring compliance across all accounts.

Answer

Create an SCP that denies s3:PutObject unless encryption headers are included.

Answer

Create an SCP that requires all objects to be uploaded with server-side encryption.

Answer

Create an SCP that denies the s3:CreateBucket action to all accounts.

Question 6

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

Accepted Answer

Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.. Option A is correct because SCPs can be attached to the root or OUs to deny actions in unapproved Regions. Option B is wrong because IAM policies can be attached to users/roles but not to OUs. Option C is wrong because resource-based policies are attached to individual resources. Option D is wrong because CloudTrail trails only log events, not enforce policies.

Answer

Create a resource-based policy on each resource type that denies creation in unapproved Regions.

Answer

Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

Answer

Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

Question 7

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with a specific KMS key. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the specified KMS key is used.. Using an SCP under the root OU prevents any account from creating unencrypted buckets or using a different KMS key. Option A is wrong because individual account IAM policies are harder to manage at scale. Option C is wrong because AWS Config can detect but not enforce. Option D is wrong because CloudFormation StackSets require manual deployment to each account.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them retroactively.

Answer

Deploy a CloudFormation StackSet that creates a bucket policy in each account requiring encryption.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless the specified KMS key is used.

Question 8

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

Accepted Answer

Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.. Option D is correct because using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect VPCs to the shared services VPC.

Answer

Use a single TGW route table for all attachments and control traffic with security groups.

Question 9

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.. Option A is correct because a service control policy (SCP) can be applied at the AWS Organizations root, OU, or account level to deny S3 bucket operations that do not include encryption. By using a condition key like `s3:x-amz-server-side-encryption` in the SCP, you can enforce that any `s3:PutBucket*` action must specify encryption, preventing the creation or modification of buckets without SSE. This provides a preventive, centralized control that cannot be overridden by account administrators.

Answer

Set the default encryption on each bucket to disable encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.

Answer

Create an IAM policy with a global condition for SSE and attach it to all users and roles.

Question 10

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.. Option B is correct because AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Answer

Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.

Answer

Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.

Answer

Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.

Question 11

A company is planning to migrate its on-premises workload to AWS. The workload consists of a stateful web application that requires a static IP address for whitelisting by third-party services. The company will use a multi-AZ deployment. Which TWO services should be used together to meet these requirements?

Accepted Answer

Network Load Balancer (NLB). A Network Load Balancer (NLB) provides a static IP address per Availability Zone, which can be whitelisted by third-party services. It operates at Layer 4 and can handle stateful web application traffic without modifying the source IP, preserving client IP visibility for the application. Combined with a multi-AZ deployment, the NLB ensures high availability and a fixed IP endpoint for external whitelisting.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 12

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

Accepted Answer

Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway. A NAT Gateway placed in a public subnet with an Internet Gateway attached allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is the standard AWS pattern for outbound-only internet access from private subnets.

Answer

Create a VPC Peering connection to a public VPC

Answer

Add an Internet Gateway to the VPC and route the private subnet's route table to it

Answer

Modify the PrivateSubnet to assign public IP addresses on launch

Question 13

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?

Accepted Answer

AWS IAM Identity Center (AWS SSO) with an AWS Managed Microsoft AD directory. AWS IAM Identity Center (formerly AWS SSO) can be integrated with an AWS Managed Microsoft AD directory to provide a single sign-on experience across multiple AWS accounts and business applications. This integration allows users to authenticate using their existing on-premises Active Directory credentials via AD Connector or a two-way forest trust, enabling seamless access to the AWS Management Console, command-line interface, and supported SAML 2.0 applications.

Answer

Amazon Cognito user pools

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Question 14

A company wants to implement a data perimeter to ensure that only authorized accounts can access their S3 buckets. Which TWO steps should they take?

Accepted Answer

Use SCPs to deny access from external accounts.. Option B is correct because bucket policy with aws:SourceAccount condition ensures only specific accounts. Option D is correct because SCPs can deny access from outside the organization. Option A is wrong because it's for CloudTrail. Option C is wrong because it's for VPC endpoints. Option E is wrong because it's for network perimeter, not account-level.

Answer

Use VPC endpoints with bucket policies.

Answer

Enable CloudTrail to log access.

Answer

Use AWS Network Firewall.

Question 15

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

Accepted Answer

Use AWS Organizations to create a central management account and use AWS Systems Manager Explorer to aggregate operational data.. Option D is correct because AWS Systems Manager Explorer, when used with AWS Organizations, provides a single-pane-of-glass dashboard that aggregates operational data (e.g., cost reports, security findings, resource inventory) across multiple accounts. The central management account in Organizations enables Explorer to collect and display data from all member accounts without requiring individual connections or manual aggregation.

Answer

Use Amazon QuickSight to connect to each account's AWS Cost and Usage Report and AWS Config data.

Answer

Use AWS Control Tower to set up a landing zone and use the built-in dashboard for operational data.

Answer

Use AWS Config aggregator to collect resource configurations from all accounts.

SAP-C02 Practice Test 15 — 15 Questions

Exhibit

SAP-C02 Practice Test 15 — 15 Questions

Exhibit