SAP-C02 Practice Test 36 — 15 Questions

Question 1

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

Accepted Answer

Use AWS Config rules to check AMI IDs against a parameter store and auto-remediate.. Option D is correct because AWS Config rules in each account can check the AMI ID against a centralized parameter store. Option A is wrong because SCPs cannot enforce AMI IDs. Option B is wrong because it requires manual tagging. Option C is wrong because IAM policies cannot restrict AMI IDs based on source account.

Answer

Tag approved AMIs and use IAM policies to require that tag.

Answer

Use an IAM policy in each account to allow only specific AMI IDs.

Answer

Use an SCP to deny ec2:RunInstances unless the AMI ID matches an approved list.

Question 2

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

Accepted Answer

Users can be granted access to multiple accounts from a central location.. Options A and D are correct. Option B is wrong because Identity Center does not use IAM users directly. Option C is wrong because it creates permission sets, not IAM roles in the management account. Option E is wrong because it integrates with Active Directory, but it is not required for all users.

Answer

Users must be IAM users in each account.

Answer

Identity Center requires an on-premises Active Directory.

Answer

Permission sets are assigned to IAM roles in the management account.

Question 3

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.. Option A is correct because CloudTrail logs management events, including IAM API calls, to CloudWatch Logs. Option D is correct because a CloudWatch Logs metric filter and alarm can detect specific API events and trigger notifications. Option B is wrong because SCPs cannot log events. Option C is wrong because AWS Config does not log API calls. Option E is wrong because IAM Access Analyzer is for analyzing policies, not logging.

Answer

Use AWS Config to record IAM role changes and stream to CloudWatch Logs.

Answer

Create an SCP that denies IAM role creation and modification.

Answer

Enable IAM Access Analyzer to monitor IAM role usage.

Question 4

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

Accepted Answer

Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.. Option D is correct because a transit gateway with attachment to the inspection VPC (with a firewall appliance) and routing all outbound traffic through it provides centralized inspection. Option A is wrong because VPC peering does not support transitive routing. Option B is wrong because Cloud WAN can be used but it's more complex than needed. Option C is wrong because a central NAT gateway in the security account would require routing all traffic through it, which is less flexible.

Answer

Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

Answer

Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

Answer

Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

Question 5

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

Accepted Answer

Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.. Option D is correct because SCPs can deny the creation of S3 buckets without encryption or with the wrong KMS key, and AWS Config rules can detect non-compliant existing buckets for remediation. Option A is wrong because IAM policies alone cannot enforce encryption at the organizational level across multiple accounts. Option B is wrong because AWS CloudTrail only logs, not enforces. Option C is wrong because AWS Service Catalog is not designed for this purpose.

Answer

Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.

Answer

Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.

Question 6

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

Accepted Answer

Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.. Option B is correct because it centralizes logs with minimal overhead. Option A is wrong because separate buckets require more management. Option C is wrong because CloudWatch Logs in each account lacks centralization. Option D is wrong because Kinesis Firehose adds unnecessary complexity.

Answer

Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.

Answer

Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.

Question 7

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

Accepted Answer

Use the IAM Identity Center console to add the member account as a delegated administrator.. Option B is correct because IAM Identity Center can register member accounts as delegated administrators. Option A is wrong because IAM roles cannot manage IAM Identity Center. Option C is wrong because SCPs are not for delegation. Option D is wrong because RAM does not share IAM Identity Center.

Answer

Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.

Answer

Use a service control policy to allow the member account to manage IAM Identity Center.

Answer

Create an IAM role in the management account and allow the member account to assume it.

Question 8

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Accepted Answer

Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.. Options A, C, and D are correct. Option B is wrong because CloudTrail is logging, not preventive. Option E is wrong because SCPs cannot enforce approval workflows.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

Answer

Enable AWS CloudTrail to log all IAM role creation events.

Question 9

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

Accepted Answer

The SCP applies to the production account because it is attached to the root.. Option A is correct because SCPs affect all accounts in the organization. Option B is wrong because SCPs do not affect management account. Option C is wrong because the production account is not the management account. Option D is wrong because SCPs override IAM permissions.

Answer

The production account's IAM policy denies s3:DeleteBucket.

Answer

The SCP only applies to the management account.

Answer

The production account is the management account.

Question 10

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

Accepted Answer

Create an IAM role in each target account with a trust policy allowing the management account to assume it.. Option C is correct because it requires an IAM role in the target accounts that StackSets can assume. Option A is wrong because StackSets use roles, not user credentials. Option B is wrong because CloudFormation service role is for stack operations, not cross-account. Option D is wrong because SCPs cannot grant permissions.

Answer

Create IAM users in target accounts with AdministratorAccess.

Answer

Use a CloudFormation service role in the management account.

Answer

Apply an SCP to allow CloudFormation actions across accounts.

Question 11

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

Accepted Answer

Register the member account as a delegated administrator for GuardDuty.. Options B and D are correct. Option A is wrong because GuardDuty does not require an SCP. Option C is wrong because the service must be enabled in the management account. Option E is wrong because the delegated administrator account is a member account, not the management account.

Answer

The delegated administrator must be the management account.

Answer

Create an SCP that allows GuardDuty actions in the member account.

Answer

Enable GuardDuty in all member accounts.

Question 12

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

Accepted Answer

Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.. Option D is correct because each account must have a subscription filter that sends logs to the cross-account destination, and the destination's access policy must allow the source accounts to write. Additionally, KMS key policy must grant the CloudWatch Logs service principal in the source accounts permission to use the key. Option A is wrong because using the default CloudWatch Logs encryption key does not provide customer-managed encryption. Option B is wrong because the destination is in the logging account, not in the source accounts. Option C is wrong because S3 is not used.

Answer

Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.

Answer

Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.

Answer

Use the default AWS-managed KMS key for CloudWatch Logs in each source account.

Question 13

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

Accepted Answer

Use AWS SSO to assign the finance group to the finance OU accounts only.. Option D is correct because AWS SSO allows assignment of users/groups to specific accounts, and the finance group can be assigned only to finance OU accounts. Option A is wrong because SCPs affect all users, not just from a specific IdP. Option B is wrong because IAM roles in each account would require manual management. Option C is wrong because the IdP cannot manage AWS account permissions directly.

Answer

Configure the external IdP to send a SAML attribute that AWS uses to enforce permissions.

Answer

Create an SCP that denies access to non-finance accounts for users from the finance group.

Answer

Create IAM roles in each finance account and trust the IdP with a condition on the group attribute.

Question 14

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.. Option D is correct because SCPs deny non-compliant API calls, and CloudFormation hooks prevent non-compliant stacks. Option A is wrong because Config is detective, not preventive. Option B is wrong because Lambda triggered by CloudTrail is reactive. Option C is wrong because Systems Manager is not for enforcement at launch time.

Answer

Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

Answer

Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 15

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an organization trail in the management account with CloudTrail.. Option C is correct because AWS CloudTrail can be configured in the management account to log all accounts in the organization. Option A is wrong because it requires creating trails in each account manually. Option B is wrong because CloudWatch Logs does not capture API calls. Option D is wrong because S3 access logs record S3 operations only.

Answer

Enable CloudWatch Logs in each account and stream to a central log group.

Answer

Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Enable S3 server access logs on all accounts and send to a central bucket.