SAP-C02 Practice Test 41 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation. Options A and D are correct. SCPs can prevent disabling CloudTrail or modifying the trail. AWS Config rules can detect missing or misconfigured trails. Option B is wrong because IAM roles do not enforce CloudTrail. Option C is wrong because Lambda can create but not enforce. Option E is wrong because CloudFormation can deploy but not prevent removal.

Answer

Create an IAM role in each account that requires CloudTrail to be enabled

Answer

Use CloudFormation StackSets to deploy a CloudTrail trail in each account

Answer

Use AWS Lambda to automatically re-enable CloudTrail if it is disabled

Question 2

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

Accepted Answer

Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.. Option D is correct because sharing the RDS snapshot with each account and restoring as a read replica in the same region avoids data transfer costs. Option A is wrong because a single cross-region replica incurs data transfer costs. Option B is wrong because direct cross-account access is not supported for read replicas. Option C is wrong because a VPC endpoint does not eliminate data transfer costs for RDS replication.

Answer

Use a VPC endpoint to share the database across accounts without data transfer costs.

Answer

Create a cross-region read replica in the central account and grant access to other accounts.

Answer

Create an IAM role in each account to access the central RDS instance directly.

Question 3

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.. Option C is correct because a Transit Gateway with a central inspection VPC (using a firewall appliance) allows routing all inter-VPC traffic through the inspection point. Option A is wrong because VPC peering does not provide a central inspection point. Option B is wrong because Direct Connect is for on-premises connectivity. Option D is wrong because Network Load Balancer does not perform traffic inspection.

Answer

Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.

Answer

Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC.

Question 4

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.. Using an SCP at the root OU is the most efficient way to enforce the policy across all accounts, as it applies to all member accounts and cannot be overridden by account administrators. Option A is wrong because SCPs can enforce restrictions. Option B is wrong because it would require per-account changes. Option D is wrong because bucket policies are account-specific and do not enforce across accounts.

Answer

Use AWS Config rules to detect and remediate public buckets in each account.

Answer

Create a CloudFormation StackSet to deploy bucket policies in every account.

Answer

Use IAM roles to restrict users from modifying bucket public access settings.

Question 5

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

Accepted Answer

Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.. Option B is correct because cross-account delivery to a central S3 bucket with S3 Lifecycle policies minimizes storage costs and centralizes logs. Option A is wrong because CloudWatch Logs in each account requires separate retention and is not as cost-effective for long-term storage. Option C is wrong because Kinesis Data Firehose is more expensive and adds complexity. Option D is wrong because S3 replication incurs additional costs.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.

Answer

Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.

Question 6

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

Accepted Answer

The EC2 instance launch will be denied because the SCP denies actions in regions not listed.. Option B is correct. The SCP denies EC2 actions in all regions except us-east-1 and eu-west-1. Since ap-southeast-1 is not in the allowed list, the action will be denied. Option A is wrong because the SCP explicitly denies. Option C is wrong because SCPs apply to all IAM principals. Option D is wrong because there is no explicit allow; the default is allow but this deny overrides.

Answer

The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

Answer

The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

Answer

The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

Question 7

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

Accepted Answer

The SCP does not include an explicit allow for the sts:GetSessionToken action.. Option D is correct because the SCP must allow the STS:GetSessionToken action to allow MFA based temporary credentials. Option A is wrong because MFA is not required for root user in this context. Option B is wrong because SCPs override IAM permissions. Option C is wrong because SCPs apply to all principals, including users with administrative privileges.

Answer

The IAM policy attached to the users does not allow any actions.

Answer

The SCP does not apply to users who have administrative privileges.

Answer

The SCP also denies access to the root user of each account.

Question 8

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts. Option D is correct because CloudFormation StackSets can deploy the required resources across all accounts efficiently. Option A is wrong because manually configuring each account is not efficient. Option B is wrong because AWS Config can detect but not deploy. Option C is wrong because SSM Automation documents are run per account but require additional setup.

Answer

Manually create VPC flow logs in each account and point to the central S3 bucket

Answer

Use AWS Config rules to enforce flow log creation across accounts

Answer

Use AWS Systems Manager Automation to create flow logs in each account

Question 9

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

Accepted Answer

The SCP is not attached to the correct OU or root. Option B is correct because the SCP denies RunInstances only when the instance type is not t3.micro or t3.small, but it applies only to the instance resource (arn:aws:ec2:*:*:instance/*). The RunInstances action also requires permissions on other resources like images, network interfaces, etc. If the SCP does not cover those resources, the condition may not be evaluated fully, or the SCP might not deny the action if other resources are not specified. Alternatively, the SCP might not be attached to the correct OU, or there might be an allow SCP overriding it. The most common issue is that the SCP is not attached to the correct path. Option A is wrong because SCPs do not need to allow actions explicitly; they are deny-only. Option C is wrong because the syntax is correct. Option D is wrong because SCPs do not require an Allow statement to work.

Answer

The SCP syntax is invalid because it uses StringNotEquals

Answer

The SCP must also allow the allowed instance types in a separate statement

Answer

The SCP does not include an Allow statement for the allowed instance types

Question 10

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

Accepted Answer

Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.. Option C is correct because SCPs can deny the creation of IAM roles that do not match the required trust policy, enforcing the use of specific roles. Option A is wrong because IAM roles in each account require manual setup. Option B is wrong because AWS CloudFormation StackSets can deploy the roles but cannot prevent creation of non-compliant roles. Option D is wrong because AWS Config can detect but not prevent.

Answer

Use AWS Config rules to detect non-compliant roles and send alerts.

Answer

Deploy the IAM roles using AWS CloudFormation StackSets.

Answer

Request each business unit to create the required IAM roles manually.

Question 11

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. Option A is correct because S3 Object Lock in compliance mode prevents any user from overwriting or deleting objects for the specified retention period. Option B is wrong because MFA Delete does not prevent root user deletion. Option C is wrong because bucket policies can be changed. Option D is wrong because versioning alone does not prevent deletion.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 12

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

Accepted Answer

The bucket policy only grants access to the root user of account 123456789012, not to other accounts.. Option C is correct. The bucket policy grants access only to the root user of account 123456789012 (the bucket owner account), not to other accounts. The developer's account (111111111111) is not authorized. Option A is wrong because secure transport is required, but the request likely uses HTTPS. Option B is wrong because signed requests are used. Option D is wrong because the bucket policy explicitly allows access, but only to the specified principal.

Answer

The bucket policy denies access from all accounts except 123456789012.

Answer

The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.

Answer

The request is not signed, so it is denied by the aws:SecureTransport condition.

Question 13

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Accepted Answer

Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.. Options A and D are correct. Option A: VPC Flow Logs can be published to a central bucket using a bucket policy that allows the member accounts to write. Option D: The bucket policy must grant s3:PutObject permissions to the member accounts' VPC Flow Logs service. Option B is wrong because bucket policies cannot be applied via SCP. Option C is wrong because SCPs cannot be attached to resources. Option E is wrong because sharing the bucket via RAM is not needed; bucket policy suffices.

Answer

Attach an SCP to the logging account that allows PutObject to the bucket.

Answer

Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.

Answer

Attach an SCP to the member accounts that allows them to create flow logs.

Question 14

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

Accepted Answer

Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions. Option D is correct because SCPs can deny creation of roles with trust policies that include a specific condition (like a principal that is not within the organization) unless approved. Option A is wrong because IAM policies cannot prevent role creation. Option B is wrong because AWS Config can detect but not deny. Option C is wrong because Lambda can revoke but not prevent.

Answer

Use IAM policies to restrict who can create roles

Answer

Use AWS Lambda to automatically delete non-compliant roles

Answer

Use AWS Config rules to detect and alert on risky trust policies

Question 15

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

Accepted Answer

The trail is not an organization trail. Option D is correct because the trail is not an organization trail (IsOrganizationTrail: false). Organization trails automatically apply to all accounts in the organization. Without that, each account must create its own trail. Option A is wrong because global service events are enabled. Option B is wrong because multi-region is not required for management events if the trail is in the correct region, but organization trail is the key. Option C is wrong because log file validation does not affect coverage.

Answer

The trail is not a multi-region trail

Answer

The trail does not include global service events

Answer

The trail has log file validation enabled, which prevents cross-account delivery