SAP-C02 Practice Test 47 — 15 Questions

Question 1

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.. Option C is correct because Service Control Policies (SCPs) can be used to enforce that CloudTrail and Config are enabled and cannot be disabled by member accounts. Option A is wrong because CloudFormation StackSets require manual deployment to each account. Option B is wrong because AWS Config rules alone cannot enforce CloudTrail. Option D is wrong because IAM permissions boundaries do not enforce service enablement.

Answer

Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.

Answer

Use IAM permissions boundaries to restrict what users can do in each account.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Question 2

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

Accepted Answer

Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.. Option A is correct because S3 bucket policies with condition keys for AWS Organizations allow secure cross-account access. Option B is wrong because presigned URLs expire and require management. Option C is wrong because IAM roles require users to switch roles. Option D is wrong because making the bucket public is insecure.

Answer

Make the bucket public with read-only access.

Answer

Generate presigned URLs for each account to access the bucket.

Answer

Create IAM roles in each account with permissions to assume a role in the central account.

Question 3

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Accepted Answer

Create a StackSet with the template and target the OU, enabling automatic deployment.. Options A, C, and D are correct. AWS CloudFormation StackSets allow deploying templates to multiple accounts and regions; enabling trusted access allows StackSets to work with Organizations; adding new accounts to the OU triggers automatic deployment if StackSets are configured with automatic deployment. Option B is wrong because SCPs cannot create resources. Option E is wrong because AWS Config cannot create resources.

Answer

Use AWS Config rules to detect missing resources and deploy them via Lambda.

Answer

Create an SCP that requires the creation of those resources.

Question 4

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

Accepted Answer

The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.. Option D is correct because the user must have permission from the management account to assume the role, and the role itself must trust the management account. The policy shown is correct, but the role in the member account must have a trust policy that allows the management account to assume it. Option A is wrong because SCPs can deny but not the primary issue. Option B is wrong because IAM roles are not regional. Option C is wrong because the policy allows all accounts.

Answer

The IAM role does not exist in the same region as the user.

Answer

An SCP in the member account denies the sts:AssumeRole action.

Answer

The policy does not specify the exact member account ARN.

Question 5

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

Accepted Answer

The SCP policy document does not contain a Deny statement for the regions.. Option B is correct because the SCP shown is only a list of policies; the actual policy content (the statement) is not displayed. It is possible that the SCP does not contain the intended deny rule or has an Allow effect that overrides. Option A is wrong because SCPs affect all users, including root. Option C is wrong because SCPs can deny actions based on region conditions. Option D is wrong because SCPs apply to all services uniformly unless specified otherwise.

Answer

The SCP is not applied to the root user of the member account.

Answer

The SCP cannot restrict actions based on region.

Answer

The SCP is overridden by an Allow policy attached to the account.

Question 6

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.. Option D is correct because AWS Transit Gateway allows you to create separate route tables per VPC attachment, and you can associate a network ACL (or security group) at the VPC level to control traffic between specific VPCs. Option A is wrong because VPC endpoints are for accessing AWS services privately. Option B is wrong because a single route table would allow all VPCs to communicate. Option C is wrong because VPC peering does not provide central management.

Answer

Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

Answer

Create VPC peering connections between all VPCs and use route tables to control access.

Answer

Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

Question 7

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.. Option B is correct because SCPs can deny EC2:RunInstances if the NetworkInterface has AssociatePublicIpAddress set to true. Option A is wrong because IAM policies can be overridden by service-linked roles. Option C is wrong because the 'Block public access' feature is for S3. Option D is wrong because it is detective, not preventive.

Answer

Use the Amazon EC2 'Block public access' feature at the account level.

Answer

Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.

Answer

Use AWS Config to detect instances with public IPs and automatically terminate them.

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.. Options A and C are correct. CloudTrail logs root user activities, and CloudWatch Events can trigger alerts. Option B is wrong because SCPs cannot restrict root user actions. Option D is wrong because IAM roles are for human users, not root. Option E is wrong because Config does not monitor root activities specifically.

Answer

Use AWS Config rules to detect root user usage.

Answer

Create an IAM role for root user with limited permissions.

Answer

Attach a service control policy (SCP) to all accounts to deny root user actions.

Question 9

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

Accepted Answer

Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.. Option C is correct because SCPs can centrally deny actions across all accounts in an organization, enforcing encryption and blocking anonymous access without requiring changes to each account. Option A (IAM roles) requires per-account setup and cannot prevent root user actions. Option B (bucket policies) must be applied per bucket. Option D (AWS Config rules) can detect violations but not prevent them proactively.

Answer

Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.

Answer

Use S3 bucket policies with Deny statements for anonymous access and missing encryption.

Answer

Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.

Question 10

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Option C is correct because SCPs can restrict the Region where resources can be created, and AWS Config can detect noncompliant resources. Option A is wrong because VPC endpoints do not restrict resource creation. Option B is wrong because AWS WAF is for web traffic. Option D is wrong because resource-based policies alone cannot prevent resource creation in other regions.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 11

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

Accepted Answer

No, because the Deny statement blocks all HTTP requests regardless of encryption.. Option C is correct. The first statement denies all S3 actions if SecureTransport is false (HTTP), which applies regardless of encryption. The second statement allows PutObject only with SSE-S3, but it is conditional on HTTPS? No, the condition is only on encryption. However, the Deny overrides Allow. Since the request is HTTP, the Deny matches and the request is denied. Option A is wrong because the Deny applies to HTTP. Option B is wrong because the Deny overrides Allow. Option D is wrong because SSE-S3 does not satisfy the SecureTransport condition.

Answer

Yes, because the Deny statement only applies to non-encrypted requests.

Answer

Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.

Answer

No, because the Allow statement requires HTTPS transport.

Question 12

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

Accepted Answer

Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.. Option A is correct because AWS Backup requires cross-account role assumption and specific backup permissions. Option B is wrong because KMS permissions are needed only if using custom keys. Option C is wrong because S3 permissions are not required for backup. Option D is wrong because Config permissions are not needed.

Answer

Create a customer managed key in the backup account and share it with member accounts.

Answer

Grant the backup account full S3 access to member account buckets.

Answer

Enable AWS Config in member accounts to track backup compliance.

Question 13

A company has a multi-account AWS environment with 50 accounts. They need to implement a centralized logging solution for VPC Flow Logs, CloudTrail, and AWS Config logs. The logs must be stored in a central S3 bucket and encrypted with a customer-managed KMS key. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create an S3 bucket policy that grants permissions to the CloudTrail and AWS Config service principals from all accounts to write logs.. Option A is correct because the central S3 bucket must allow log delivery from all accounts via bucket policy. Option B is correct because CloudTrail trails can be configured to deliver to a central bucket across accounts. Option D is correct because KMS key policy must grant permissions to the log delivery services across accounts. Option C is wrong because VPC Flow Logs cannot be directly aggregated to a central account without third-party tools or cross-account delivery. Option E is wrong because AWS Config data is per-account; aggregation is done via Aggregator, not direct log delivery.

Answer

Use AWS Config aggregator to collect configuration data from all accounts into a central account.

Answer

Enable VPC Flow Logs in each account and deliver them to a central CloudWatch Logs group.

Question 14

A company is implementing a new multi-account strategy using AWS Organizations. The central IT team wants to delegate management of certain AWS services to individual account administrators while maintaining centralized governance. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create IAM roles in each account that can be assumed from the central account with limited permissions.. Option A is correct because AWS CloudFormation StackSets allows central deployment of resources across accounts. Option D is correct because IAM roles with cross-account trust allow delegated administration. Option B is incorrect because root user access should be restricted, not granted. Option C is incorrect because SCPs can restrict actions but cannot delegate management. Option E is incorrect because sharing root credentials violates security best practices.

Answer

Create SCPs that allow all actions except those managed centrally.

Answer

Share the root user credentials of each account with the respective administrator.

Answer

Grant each account administrator full access to the management account.

Question 15

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

Accepted Answer

Use AWS Control Tower Account Factory Customization (AFC).. Option B is correct because Account Factory Customization (AFC) in Control Tower allows automatic deployment of custom templates when new accounts are provisioned. Option A is wrong because StackSets require manual invocation. Option C is wrong because Service Catalog does not automate deployment. Option D is wrong because Lifecycle hooks are not part of Control Tower.

Answer

Use AWS Service Catalog portfolio to share templates.

Answer

Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

Answer

Use AWS CloudFormation StackSets and manually trigger them for new accounts.