SAP-C02 Practice Test 35 — 15 Questions

Question 1

A company has multiple AWS accounts and wants to centralize logging from all accounts to a single S3 bucket in a logging account. The logs must be encrypted with a KMS key managed by the logging account. What is the MOST secure way to allow cross-account S3 server access logs?

Accepted Answer

Use a bucket policy in the logging account that grants the S3 log delivery service principal access to write objects, and configure the KMS key policy to allow the log delivery service to use the key.. Option C is correct because the S3 bucket policy can grant cross-account permissions to the logging service principal, and the logging account's KMS key policy must allow the log delivery service to use the key. Option A is wrong because KMS key policies must explicitly allow the service to use the key. Option B is wrong because cross-account roles are not automatically used by S3 logging. Option D is wrong because the bucket policy alone does not handle KMS encryption.

Answer

Set the bucket policy to allow the source accounts to write logs, and enable default encryption on the bucket with the KMS key.

Answer

Create an IAM role in the logging account and allow the source accounts to assume it, then configure the source accounts to use that role for logging.

Answer

Configure the logging account's KMS key with a policy that allows the S3 service to use it, and set the bucket policy to allow the source accounts to write logs.

Question 2

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

Accepted Answer

Use AWS Organizations to register the member account as a delegated administrator for the service.. Option A is correct because AWS Organizations allows you to register a member account as a delegated administrator for a service, which then allows that service to perform cross-account actions. Option B is wrong because creating a service-linked role in each account is not necessary; the delegated administrator can create them on behalf of other accounts. Option C is wrong because the Organizations management account does not need to grant cross-account access; the service can do it. Option D is wrong because IAM roles in each account are not needed if the service supports delegated administration.

Answer

Create a service-linked role in each account to allow the service to perform actions.

Answer

Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.

Answer

Create an IAM role in each account with a trust policy that allows the service to assume it.

Question 3

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

Accepted Answer

Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.. Option C is correct because AWS SSO supports connecting to an existing Active Directory via AWS Directory Service for Microsoft Active Directory, which can be used as an identity source. Option A is wrong because AWS SSO does not directly integrate on-premises AD; it requires a directory in AWS. Option B is wrong because IAM Identity Center (successor to AWS SSO) also requires a directory. Option D is wrong because SAML 2.0 federation with on-premises AD is not a built-in AWS SSO feature; it requires a separate identity provider.

Answer

Use SAML 2.0 federation between AWS SSO and the on-premises AD.

Answer

Use AWS IAM Identity Center with an external identity provider that supports SCIM.

Answer

Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

Question 4

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

Accepted Answer

Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.. Option A is correct because the S3 bucket policy must allow the VPC Flow Logs service principal to write objects, and the KMS key policy must allow the same service principal to use the key. Option B is wrong because the source account's KMS key would not be used; the logging account's key encrypts the bucket. Option C is wrong because VPC Flow Logs do not use IAM roles for cross-account delivery; they use the bucket policy. Option D is wrong because the source account's bucket policy is irrelevant; the destination bucket is in the logging account.

Answer

Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

Answer

Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

Answer

In the source account, create a KMS key and allow the logging account to use it for encryption.

Question 5

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

Accepted Answer

Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.. Option B is correct because you can use an SCP to deny ec2:RunInstances if the request does not include the required tag. Option A is wrong because AWS Config can detect non-compliance but not prevent it. Option C is wrong because tagging is not automatic; it must be enforced. Option D is wrong because IAM policies in individual accounts can be overridden by SCPs, but SCPs are more effective for organization-wide enforcement.

Answer

Create an IAM policy in each account that requires the tag for ec2:RunInstances.

Answer

Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

Answer

Configure the EC2 service to automatically add the tag to all instances.

Question 6

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.. Option C is correct because AWS Organizations SCPs can restrict access to networking actions in specific accounts or OUs. Option A is wrong because IAM roles can be assumed by developers, but they don't prevent developers from using other roles. Option B is wrong because AWS Config is detective, not preventive. Option D is wrong because resource tags do not prevent actions.

Answer

Use IAM roles to grant developers access only to their own resources.

Answer

Use AWS Config rules to detect changes to networking resources.

Answer

Use resource tags to identify networking resources and apply IAM conditions.

Question 7

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The policy denies all instance types except t3.micro and t3.small.. Option B is correct because the policy denies ec2:RunInstances for instance types that are not t3.micro or t3.small. Since t3.medium is not in the allowed list, the action is denied. Option A is wrong because the policy allows the action for allowed types. Option C is wrong because the condition is on instance type, not AMI. Option D is wrong because there is no explicit allow, but the default implicit deny is overridden by the explicit deny.

Answer

The policy has a syntax error that causes all actions to be denied.

Answer

The policy does not explicitly allow ec2:RunInstances.

Answer

The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.

Question 8

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

Accepted Answer

The bucket policy restricts access to a specific account only.. Option D is correct because the bucket policy only allows the LogDelivery role from account 111122223333, but the logs may be coming from a different account (e.g., the source account of the logs). Option A is wrong because the policy does not deny, it allows. Option B is wrong because the policy is correct for the given role. Option C is wrong because the policy allows PutObject, not GetObject.

Answer

The bucket policy lacks s3:GetObject permission.

Answer

The IAM role is not trusted by the bucket policy.

Answer

The bucket policy has an explicit deny that overrides the allow.

Question 9

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

Accepted Answer

Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.. Option D is correct because it allows centralized management with self-service via Resource Access Manager. Option A is wrong because VPNs are not scalable. Option B is wrong because VPC peering does not scale to hundreds of accounts. Option C is wrong because VPC endpoints are for services, not VPC-to-VPC.

Answer

Create a VPN connection from each VPC to a central network appliance.

Answer

Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

Answer

Create VPC peering connections between each VPC and a central VPC.

Question 10

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

Accepted Answer

Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.. Option C is correct because a multi-region key is not needed, and cross-account access requires key policy. Option A is wrong because SSE-S3 does not allow cross-account access control. Option B is wrong because SSE-C requires managing keys externally. Option D is wrong because S3 bucket policies cannot grant access to KMS keys.

Answer

Use SSE-S3 encryption. Grant cross-account access via bucket policy.

Answer

Use SSE-C encryption. Provide the same customer key to all accounts.

Answer

Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

Question 11

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Accepted Answer

Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.. Options A, C, and D are correct. Option B is wrong because VPC peering is not needed if Transit Gateway is used. Option E is wrong because Route 53 Resolver endpoints are for hybrid, not inter-VPC.

Answer

Route 53 Resolver inbound endpoints in the shared services VPC.

Answer

VPC peering connections between each VPC and the shared services VPC.

Question 12

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

Accepted Answer

The principal should be the CloudTrail service principal, not the root account of 111111111111.. Option D is correct because CloudTrail uses a service principal, not the root account. Option A is wrong because the policy allows PutObject. Option B is wrong because CloudTrail delivers logs with bucket-owner-full-control. Option C is wrong because the resource is correct.

Answer

The resource ARN is incorrect.

Answer

The bucket policy requires the x-amz-acl header, which CloudTrail does not set.

Answer

The bucket policy does not allow s3:PutObject for the account 222222222222.

Question 13

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

Accepted Answer

The account has an unpaid AWS bill.. Option C is correct because accounts are typically suspended due to non-payment of AWS bills. Option A is wrong because AWS Organizations does not suspend accounts for SCP violations. Option B is wrong because nothing in the output indicates a service compromise. Option D is wrong because the account was created after the management account, so it was not the root.

Answer

The account was suspended due to a Service Control Policy (SCP) violation.

Answer

The account was suspended due to a security breach detected by AWS.

Answer

The account was removed from the organization by the root user.

Question 14

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

Accepted Answer

Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.. Option A is correct because SCPs can enforce tagging at the API level across all accounts in the organization. Option B is wrong because Lambda functions require manual setup per account. Option C is wrong because AWS Config rules only detect non-compliance, not prevent creation. Option D is wrong because CloudFormation StackSets require manual template application.

Answer

Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

Answer

Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

Question 15

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

Accepted Answer

Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.. Option A is correct because sharing the directory via RAM allows cross-account access. Option B is wrong because AD Connector per VPC adds management overhead. Option C is wrong because VPNs are not needed for this. Option D is wrong because directory cloning is not for cross-account access.

Answer

Set up a VPN connection from each VPC to the on-premises AD.

Answer

Clone the directory and deploy it in each account.

Answer

Deploy an AD Connector in each VPC pointing to the on-premises AD.