SAP-C02 Practice Test 38 — 15 Questions

Question 1

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

Accepted Answer

Use AWS Organizations with a delegated administrator for IAM.. Option B is correct because AWS Organizations allows you to create service-linked roles and delegate administration. Option A is wrong because it gives full admin. Option C is wrong because it does not scale across accounts. Option D is wrong because it is not for role creation.

Answer

Use AWS Single Sign-On with permission sets.

Answer

Create an IAM user in each account with AdministratorAccess.

Answer

Use cross-account roles with a policy that allows iam:CreateRole.

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to deploy the AWS Config rule across all accounts in the organization.. Option D is correct because AWS CloudFormation StackSets can deploy the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, it applies to new accounts as they are created. Option A is wrong because AWS Config rules are not automatically applied to new accounts unless set up via delegation. Option B is wrong because Service Control Policies (SCPs) control permissions but cannot directly enable AWS Config rules. Option C is wrong because AWS CloudTrail is for logging API calls, not for deploying Config rules.

Answer

Use an SCP in the root to require encryption on S3 buckets.

Answer

Create an AWS Config rule in the management account and delegate an admin account to apply it to all member accounts.

Answer

Configure AWS CloudTrail to automatically enable the AWS Config rule in new accounts.

Question 3

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

Accepted Answer

Add a bucket policy on the central S3 bucket that grants the service principal 'delivery.logs.amazonaws.com' s3:PutObject permission.. Option A is correct because VPC Flow Logs can be published to a cross-account S3 bucket, but the bucket policy must allow the delivery service. Option C is correct because the bucket policy must grant the VPC Flow Logs service principal (delivery.logs.amazonaws.com) permission to write. Option B is wrong because the bucket should be in the logging account, not in member accounts. Option D is wrong because IAM roles are not used for VPC Flow Logs delivery. Option E is wrong because the management account is not needed for this setup.

Answer

Create an IAM role in the logging account that the member accounts can assume to put objects.

Answer

Create an S3 bucket in each member account to receive Flow Logs, and replicate to the central bucket.

Answer

Enable AWS CloudTrail in the management account to aggregate logs.

Question 4

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

Accepted Answer

Restrict access to the management account and use it only for organization management tasks.. Option C is correct because the management account should have limited access and be reserved for organization management tasks. Option A is wrong because enabling all services in the management account increases risk. Option B is wrong because the management account cannot be used as a payer account if it is also used for production. Option D is wrong because the management account should not be used for development.

Answer

Enable all AWS services in the management account to centrally manage them.

Answer

Use the management account as the payer account and also host production workloads.

Answer

Use the management account for development environments to avoid creating additional accounts.

Question 5

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

Accepted Answer

Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.. Option C is correct because it uses a Service Control Policy (SCP) to deny creation of buckets without SSE-KMS, and a Config rule with auto-remediation via Lambda to fix existing non-compliant buckets. Option A is wrong because SCPs cannot remediate existing buckets. Option B is wrong because CloudTrail is for logging, not enforcement. Option D is wrong because Resource Access Manager (RAM) does not enforce encryption.

Answer

Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.

Answer

Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.

Answer

Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.

Question 6

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.. Options A and C are correct. Option A: An SCP can be used to deny the sts:AssumeRole action if the request does not come from the corporate IP range. Option C: An IAM policy with a condition on the source IP can be attached to the roles. Option B is wrong because SCPs cannot be attached to roles. Option D is wrong because AWS WAF is for web traffic, not IAM. Option E is wrong because VPC endpoints do not enforce source IP.

Answer

Use a VPC endpoint for STS and restrict access to the endpoint.

Answer

Configure AWS WAF to block requests from IPs outside the corporate range.

Answer

Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.

Question 7

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

Accepted Answer

Use Systems Manager Explorer with multi-account management. Option C is correct because Systems Manager Explorer provides a centralized view of operational data across accounts. Option A is wrong because Systems Manager Automation runbooks are for automation, not centralized management. Option B is wrong because AWS Config is for compliance, not management. Option D is wrong because CloudFormation is for infrastructure deployment.

Answer

Use AWS Config to aggregate configuration data

Answer

Use Systems Manager Automation runbooks in each account

Answer

Use CloudFormation StackSets to deploy Systems Manager agents

Question 8

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

Accepted Answer

Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.. Option B is correct because SCPs allow you to centrally control the maximum available permissions for all accounts in an organization, enabling region restrictions at the organizational level. Option A is wrong because IAM policies in individual accounts are harder to manage across many accounts. Option C is wrong because AWS Config does not enforce policies, it only checks compliance. Option D is wrong because Service Control Policies (SCPs) are the correct mechanism for this, not IAM roles.

Answer

Create an IAM role in each account with a policy to deny non-compliant regions.

Answer

Use AWS Config rules to detect and terminate instances in non-compliant regions.

Answer

Create an IAM policy in each account to deny non-compliant regions.

Question 9

A company uses AWS Organizations with a policy that denies access to services unless they are explicitly allowed. The security team wants to allow only approved services. What type of policy should they use?

Accepted Answer

Use an SCP with a Deny effect for unapproved services.. Option D is correct because an SCP with a Deny effect for unapproved services is the standard approach. Option A is wrong because Allow lists are not natively supported by SCPs. Option B is wrong because it's the opposite. Option C is wrong because service control policies are for Organizations.

Answer

Use an SCP with an Allow effect for approved services.

Answer

Use an SCP with a Deny effect for all services except approved ones.

Answer

Use an IAM policy with a Deny effect for unapproved services.

Question 10

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. Option B is correct because SCPs can be attached to OUs or accounts to deny actions that do not meet conditions. Option A is wrong because IAM policies are for users/roles within an account, not for controlling actions across accounts. Option C is wrong because AWS Config can detect non-compliant VPCs but cannot prevent creation. Option D is wrong because CloudTrail logs but does not enforce.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 11

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

Accepted Answer

Create an SCP to deny disabling AWS Config, and use an AWS Config conformance pack in a delegated admin account to enforce rules across the organization.. Option C is correct because using an SCP in the root OU to prevent disabling Config, combined with AWS Config conformance packs in a delegation admin account, ensures accounts are created with Config enabled and rules enforced without manual intervention. Option A is wrong because it requires manual setup per account. Option B is wrong because CloudFormation StackSets require manual stack instance updates. Option D is wrong because Lambda functions triggered by account creation can be delayed and may not cover all cases.

Answer

Create an AWS Config aggregator in the management account and enable Config for each account manually.

Answer

Use AWS CloudFormation StackSets to deploy a Config template to each account, and manually add new accounts to the StackSet.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail to enable Config and deploy rules whenever a new account is created.

Question 12

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Accepted Answer

Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.. Options A, C, and D are correct. A: Enable GuardDuty in the security account and designate it as the administrator for all member accounts. C: Enable Security Hub in the security account and use the integration to aggregate findings. D: Enable IAM Access Analyzer in the security account with the organization as the zone of trust. Option B is wrong because GuardDuty is region-specific and cannot be centralized in one region. Option E is wrong because Config aggregator aggregates configuration items, not security findings.

Answer

Use AWS Config aggregator in the security account to collect configuration items from all accounts.

Answer

Configure GuardDuty in the security account to monitor all regions by using a single detector.

Question 13

A company has an AWS Organization with a management account and several member accounts. The management account hosts a central S3 bucket that stores CloudTrail logs from all accounts. The company wants to ensure that only the management account can delete objects from this bucket. Which policy should be applied to the bucket?

Accepted Answer

A bucket policy that denies s3:DeleteObject unless the request is from the management account's root user.. Option B is correct because a bucket policy with a condition that denies DeleteObject actions unless the account is the management account achieves the goal. Option A is wrong because it does not prevent other accounts from deleting. Option C is wrong because SCPs cannot be applied to resources. Option D is wrong because bucket policies cannot be attached to organizational units.

Answer

An SCP that denies s3:DeleteObject for all member accounts.

Answer

An SCP that denies s3:DeleteObject for all accounts except the management account.

Answer

A bucket policy that allows s3:DeleteObject only for the organizational unit containing the management account.

Question 14

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

Accepted Answer

Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met. Option D is correct because SCPs can be used to deny S3 bucket creation or modification if encryption is not set to the required KMS key. Option A is wrong because IAM policies in individual accounts cannot be enforced across accounts. Option B is wrong because AWS Config rules can detect but not enforce. Option C is wrong because CloudFormation StackSets can deploy resources but cannot enforce existing buckets.

Answer

Create IAM policies in each account to enforce encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Deploy a CloudFormation StackSet that creates S3 buckets with encryption

Question 15

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Accepted Answer

AWS Organizations. Options A, C, and D are correct. IAM Access Analyzer helps identify external access to resources. AWS CloudTrail logs all API calls for auditing. AWS Organizations provides a central view and management of accounts. Option B is wrong because AWS Config is for resource configuration, not IAM permissions. Option E is wrong because Amazon GuardDuty is for threat detection, not IAM audit.

Answer

AWS Config

Answer

Amazon GuardDuty