SAP-C02 Practice Test 43 — 15 Questions

Question 1

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

Accepted Answer

Create an SCP that denies ec2:RunInstances unless the ami id matches an approved list.. Options A and D are correct. An SCP can deny the ec2:RunInstances action if the AMI ID is not in an approved list, and AWS Config can detect noncompliant instances. Option B is wrong because AMI IDs are account-specific and shared via RAM. Option C is wrong because IAM policies cannot enforce specific AMIs across accounts easily. Option E is wrong because CloudTrail does not prevent launches.

Answer

Use AWS Resource Access Manager to share the approved AMI with all accounts.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Attach an IAM policy to each account's IAM roles that allows only approved AMIs.

Question 2

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

Accepted Answer

Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.. Option D is correct because AWS Organizations allows you to consolidate billing and share Reserved Instance discounts across all accounts. Option A is wrong because each account would need to purchase separately, losing optimization. Option B is wrong because EC2 Reserved Instance Marketplace is for selling unused reservations. Option C is wrong because AWS Budgets is for cost tracking, not purchasing.

Answer

Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

Answer

Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

Answer

Have each account purchase its own Reserved Instances based on its usage.

Question 3

A company uses AWS Organizations with hundreds of accounts. The central IT team wants to manage IP address ranges for VPCs across all accounts using a custom AWS Resource Access Manager (RAM) resource share. They have created a resource share containing the IP address CIDR blocks (as managed prefix lists) and shared it with the organization. However, some accounts cannot see the shared prefix lists. What is the MOST likely cause?

Accepted Answer

The organization's sharing feature for Amazon VPC is not enabled in the management account.. Option D is correct because RAM sharing with an organization requires that all accounts have the sharing feature enabled via the Organization's trusted access. Option A is incorrect because RAM supports prefix lists. Option B is incorrect because resource shares can include multiple resources. Option C is incorrect because RAM sharing with the entire organization does not require individual invites.

Answer

Managed prefix lists are not supported by AWS RAM.

Answer

The accounts need to accept the resource share invitation manually.

Answer

The resource share can only include one type of resource at a time.

Question 4

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

Accepted Answer

Apply an SCP to the production OU that denies all actions to non-approved IAM roles.. Option B is correct because SCPs can deny actions on production accounts. Option D is correct because IAM roles with limited permissions can restrict developer access. Option A is incorrect because AWS Config does not prevent actions. Option C is incorrect because CloudTrail is auditing, not enforcement. Option E is incorrect because tagging does not prevent deployment.

Answer

Enable AWS CloudTrail to monitor and alert on production changes.

Answer

Use resource tags to identify development and production resources and enforce policies via SCPs.

Answer

Use AWS Config rules to detect unauthorized deployments in production.

Question 5

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

Accepted Answer

Enable AWS Config aggregator and use advanced queries to search for trust policies.. Option D is correct because using AWS Config advanced queries across accounts with aggregation is scalable. Option A is wrong because manual review is not scalable. Option B is wrong because Trusted Advisor does not cover custom policies. Option C is wrong because IAM Access Analyzer identifies external access but does not provide a full audit of trust policies.

Answer

Use AWS Trusted Advisor to check for overly permissive roles.

Answer

Write a script using AWS SDK to list roles in each account and analyze trust policies.

Answer

Use IAM Access Analyzer to generate findings for each account.

Question 6

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Accepted Answer

Create a centralized S3 bucket in the logging account.. Options A and D are correct. First, create a centralized S3 bucket to store flow logs. Then, use an SCP to enforce enabling flow logs on all VPCs. Option B is wrong because AWS Config can detect but not enforce. Option C is wrong because CloudWatch Logs cross-account subscription is not necessary if using S3. Option E is wrong because VPC Flow Logs can be delivered to S3 directly.

Answer

Configure cross-account CloudWatch Logs subscription.

Answer

Use VPC Flow Logs with Amazon Kinesis Data Firehose.

Answer

Use AWS Config rules to enable flow logs automatically.

Question 7

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

Accepted Answer

Enable default encryption with SSE-S3 or SSE-KMS.. Options A and D are correct. Option A: Blocking public access prevents unintended exposure. Option D: Enabling server-side encryption protects data at rest. Option B is wrong because S3 Transfer Acceleration does not provide security. Option C is wrong because lifecycle policies manage storage, not security. Option E is wrong because S3 Select is for querying, not security.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Answer

Enable S3 Select to filter data.

Question 8

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

Accepted Answer

Enable AWS Config in each account and use an aggregator in the security account.. AWS Config aggregator allows viewing compliance from multiple accounts. Option B is wrong because it doesn't aggregate. Option C is wrong because CloudFormation is per-account. Option D is wrong because SCPs cannot enable Config.

Answer

Apply an SCP to enable AWS Config in all accounts.

Answer

Use CloudFormation StackSets to deploy Config rules, then view in each account.

Answer

Enable AWS Config in the security account only and use cross-account roles.

Question 9

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.. Option D is correct because AWS Organizations can automatically create roles via CloudFormation StackSets or AWS CloudFormation in each account, and using a trusted access role simplifies management. Option A is wrong because manual creation does not scale. Option B is wrong because IAM groups are not cross-account. Option C is wrong because SCPs do not create roles.

Answer

Use a service control policy (SCP) to enforce the creation of the role.

Answer

Manually create the same IAM role in each account with a trust policy pointing to the security account.

Answer

Use IAM groups in the security account and grant permissions to the groups.

Question 10

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

Accepted Answer

Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.. Option A is correct because resource-based policies can be attached to VPCs to control deletion. SCPs can also be used but are account-wide. Option B is wrong because SCPs would restrict all accounts. Option C is wrong because IAM policies cannot restrict by resource tag without a specific condition. Option D is wrong because AWS Config does not prevent deletion.

Answer

Use AWS Config rules to automatically recreate any VPC that is deleted.

Answer

Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

Answer

Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.

Question 11

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

Accepted Answer

Configure VPC Flow Logs to deliver to an S3 bucket in each account, then enable S3 Cross-Region Replication to the central bucket in the logging account.. Option B is correct because it uses S3 Cross-Region Replication to aggregate logs without additional compute, and is scalable. Option A (Lambda) adds cost and complexity. Option C (Amazon Kinesis Data Firehose) is more expensive for log aggregation than replication. Option D (S3 batch operations) is not designed for real-time log delivery.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create a Lambda function in each account that copies log files to the central bucket.

Answer

Use S3 Batch Operations to copy logs from each account to the central bucket daily.

Question 12

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

Accepted Answer

Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.. Option B is correct because AWS Cost Categories allow allocation based on rules, and AWS Budgets can notify when untagged resources are created. Option A is wrong because Cost Explorer alone cannot enforce tagging. Option C is wrong because SCPs cannot enforce tagging on all resources. Option D is wrong because Trusted Advisor does not enforce tagging.

Answer

Use AWS Trusted Advisor to check for untagged resources.

Answer

Use Service Control Policies to deny creation of untagged resources.

Answer

Use AWS Cost Explorer to filter by tags and manually identify untagged resources.

Question 13

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

Accepted Answer

Create an SCP to deny PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that do not meet the requirements.. Option A is correct because SCPs can deny actions that do not meet encryption or public access requirements. Option D is correct because AWS Config rules can be used to detect and remediate non-compliant buckets. Option B is wrong because IAM permissions are per-account and not centrally enforced. Option C is wrong because tagging does not enforce security requirements. Option E is wrong because it does not enforce across all accounts; it only sets defaults for new buckets.

Answer

Use AWS Service Catalog to enforce S3 bucket encryption and public access settings.

Answer

Define a tag policy that requires encryption and public access tags on all S3 buckets.

Answer

Use IAM policies in the management account to restrict S3 permissions for all users.

Question 14

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.. Option B is correct because SCPs can be applied at the OU level to deny non-compliant actions across all accounts, providing centralized enforcement. Option A is wrong because service control policies are not applied to the management account. Option C is wrong because AWS Config rules detect non-compliance but do not enforce. Option D is wrong because custom Lambda functions would require per-account deployment and are less efficient.

Answer

Apply a service control policy (SCP) to the management account.

Answer

Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

Answer

Use AWS Config rules with automatic remediation in each account.

Question 15

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

Accepted Answer

Use Amazon EventBridge for event-driven integration.. Options A, C, and D are correct. Option A: SQS decouples services via message queues. Option C: SNS enables fan-out to multiple subscribers. Option D: EventBridge supports event-driven communication. Option B is wrong because ELB is for load balancing, not decoupling. Option E is wrong because Direct Connect is for hybrid connectivity.

Answer

Use AWS Direct Connect for private connectivity.

Answer

Use Elastic Load Balancing to distribute traffic.