SAP-C02 Practice Test 40 — 15 Questions

Question 1

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Accepted Answer

Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it. Option C is correct because the standard cross-account access pattern uses IAM roles with trust policies. Option A is wrong because IAM users are per-account and not scalable. Option B is wrong because access keys are not secure for cross-account access. Option D is wrong because SCPs are for restrictions, not granting access.

Answer

Use a service control policy to allow access from other accounts

Answer

Create IAM users in the development account for each developer

Answer

Share the access keys of an IAM user in the development account

Question 2

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.. Option C is correct because an SCP can deny access if MFA is not present, and it applies to all accounts in the organization. Option A is wrong because an IAM policy in each account requires manual effort and is not centralized. Option B is wrong because AWS Config can detect but not enforce. Option D is wrong because CloudTrail logs but does not enforce.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.

Answer

Create an IAM policy in each account that denies access without MFA.

Question 3

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the transit gateway with authorized accounts.. Option C is correct because the transit gateway can be shared with accounts via AWS Resource Access Manager (RAM), and a resource share can be created with specific accounts or OUs. Option A is wrong because SCPs can deny the creation of attachments only if they are not shared. Option B is wrong because VPC peering is separate from transit gateway. Option D is wrong because Direct Connect is for on-premises connectivity.

Answer

Use AWS Direct Connect to connect each application account to the transit gateway.

Answer

Establish VPC peering connections between each application account and the network account.

Answer

Create an SCP that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account.

Question 4

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

Accepted Answer

Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.. Option B is correct because using a Route 53 Resolver outbound endpoint in the central account and associating the private hosted zone with the shared VPC allows cross-account DNS resolution. Option A is wrong because sharing the entire private hosted zone with all accounts is not possible. Option C is wrong because Route 53 inbound endpoints only handle DNS queries from on-premises. Option D is wrong because using Route 53 Resolver rules is part of the correct solution but the zone still needs to be associated with the central VPC.

Answer

Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.

Answer

Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.

Answer

Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.

Question 5

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Accepted Answer

Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.. Options A and C are correct. A: A service role with the necessary permissions must be created in each account. C: A maintenance window in the management account can target instances in member accounts using resource groups. Option B is wrong because the SSM agent does not need to be replaced. Option D is wrong because instance profiles are not automatically created. Option E is wrong because Systems Manager does not use AWS Config for patching.

Answer

Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

Answer

Enable AWS Config in all accounts to track patch compliance.

Answer

Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

Question 6

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

Accepted Answer

Partition by date and account ID.. Option C is correct because the most common query filters are by account and date, so partitioning by date and account ID reduces scans. Option A is wrong because it does not include date, which is a common filter. Option B is wrong because it only includes account ID, missing date. Option D is wrong because region is less selective than account.

Answer

Partition by region and date.

Answer

Partition by account ID only.

Answer

Partition by account ID and region.

Question 7

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

Accepted Answer

Amazon Kinesis Data Firehose delivery stream with cross-account access. Option B is correct because Amazon Kinesis Data Firehose can receive logs from multiple accounts via subscriptions and deliver to OpenSearch. Option A is wrong because CloudWatch Logs subscription can forward logs but requires each account to have a subscription filter. Option C is wrong because S3 is a destination, not a forwarding mechanism. Option D is wrong because Lambda can process logs but is not designed for centralized cross-account ingestion.

Answer

Amazon S3 bucket with cross-account bucket policy

Answer

Amazon CloudWatch Logs subscription filter

Answer

AWS Lambda function in each account that sends logs to a central API

Question 8

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Accepted Answer

An external identity provider (IdP) such as Azure AD or Okta. Options A and D are correct. AWS SSO requires an identity source (like an external IdP) and permission sets to assign access. Option B is wrong because Cloud Directory is not used with AWS SSO. Option C is wrong because IAM users are not used for SSO. Option E is wrong because SCPs are for organizations, not SSO.

Answer

AWS Cloud Directory

Answer

A service control policy (SCP) attached to the root

Answer

An IAM user in each account

Question 9

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

Accepted Answer

Use AWS Systems Manager Quick Setup to configure patching across accounts.. Option B is correct because Systems Manager Quick Setup can configure automation across accounts from a central management account. Option A is wrong because Systems Manager Automation alone does not handle multi-account. Option C is wrong because Systems Manager Patch Manager is a component, not a multi-account solution. Option D is wrong because AWS Config is for compliance, not patching.

Answer

Use AWS Systems Manager Patch Manager in the management account.

Answer

Use AWS Systems Manager Automation documents in each account.

Answer

Use AWS Config rules to trigger patching in each account.

Question 10

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with MySQL compatibility.. Option D is correct because Amazon RDS for MySQL does not support cross-Region synchronous replication; the best option is to use Amazon Aurora Global Database with MySQL compatibility, which provides fast replication and failover. Option A is wrong because cross-Region Read Replicas are asynchronous and may have data loss. Option B is wrong because Multi-AZ is single-Region. Option C is wrong because Database Migration Service is for migration, not continuous replication with low RTO.

Answer

Use cross-Region Read Replicas with automatic failover.

Answer

Use a Multi-AZ RDS instance with a standby in another Region.

Answer

Use AWS Database Migration Service for continuous replication.

Question 11

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

Accepted Answer

Apply an SCP that denies the organizations:LeaveOrganization action.. An SCP with a Deny effect on organizations:LeaveOrganization prevents any account from leaving. Option B is wrong because IAM is account-specific. Option C is wrong because CloudTrail only logs. Option D is wrong because it doesn't prevent.

Answer

Configure IAM policies on the root user of each account to deny leave actions.

Answer

Create an AWS Config rule to detect leave attempts.

Answer

Enable AWS CloudTrail to monitor leave events and send alerts.

Question 12

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

Accepted Answer

All principals outside the organization are denied all actions.. Option B is correct because the SCP denies any action if the principal's organization ID does not match 'o-exampleorgid'. This effectively blocks all actions from principals outside the organization. Option A is wrong because it does not deny actions from all principals; it only denies those outside the org. Option C is wrong because it does not allow actions; it denies. Option D is wrong because it does not require MFA.

Answer

All principals are required to have MFA enabled.

Answer

All principals in the organization are allowed all actions.

Answer

All principals in the organization are denied all actions.

Question 13

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Accepted Answer

Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.. Options B and D are correct. B: An SCP with a condition on aws:SourceIp restricts access based on IP address across all accounts. D: An S3 bucket policy with a condition on aws:SourceVpce restricts access to specific VPC endpoints. Option A is wrong because it's not centralized. Option C is wrong because it restricts service but not network location. Option E is wrong because it restricts actions but not network.

Answer

Create an IAM policy in each account that denies access unless the request comes from the approved IP range.

Answer

Use AWS PrivateLink to access all AWS services from within the VPC.

Answer

Use AWS Resource Access Manager to share resources with approved accounts only.

Question 14

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

Accepted Answer

Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.. Option A is correct because the workload VPCs need to forward DNS queries to the outbound endpoint via a rule. Option B is wrong because the inbound endpoint is for on-premises to resolve AWS resources. Option C is wrong because a private hosted zone is not directly related to forwarding. Option D is wrong because VPC peering is not required when using Transit Gateway.

Answer

Establish VPC peering between the workload VPCs and the networking account VPC.

Answer

Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

Answer

Create a Route 53 Resolver inbound endpoint in the networking account.

Question 15

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

Accepted Answer

The launch fails because the SCP denies the action.. Option C is correct because the SCP denies RunInstances if the instance type is not t3.micro. Since m5.large is not t3.micro, the action is denied. Option A is wrong because the SCP denies the action. Option B is wrong because the condition denies non-t3.micro instances. Option D is wrong because the SCP does not allow; it denies.

Answer

The launch succeeds because the condition evaluates to true.

Answer

The launch succeeds because the SCP only denies StartInstances.

Answer

The launch succeeds because the SCP allows all instance types except t3.micro.