SAP-C02 Mock Exam 85 — 25 Questions

Question 1

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

Accepted Answer

Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.. The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag. Option C allows the services to bypass the tag requirement.

Answer

Remove the SCP from the root.

Answer

Modify the bucket policy to allow s3:PutObject without tags.

Answer

Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

Question 2

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Accepted Answer

Create a private hosted zone in the central networking account.. Option A is correct because a private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Answer

Create a public hosted zone with the same name and configure DNSSEC.

Answer

Create a Route 53 Resolver outbound endpoint in each account.

Question 3

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

Accepted Answer

Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.. AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Answer

Use AWS Organizations service control policies to deny cross-account access.

Answer

Use AWS Trusted Advisor to check for unused cross-account roles.

Answer

Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

Question 4

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

Accepted Answer

AWS Shield. AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 5

A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and bandwidth. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across different AWS accounts and route traffic to the Direct Connect virtual interface, enabling a scalable hub-and-spoke architecture for hybrid connectivity.

Answer

Amazon Route 53 Resolver

Answer

VPC peering

Answer

AWS Client VPN

Question 6

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.. Option B is correct because a service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Answer

Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.

Answer

Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.

Question 7

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

Accepted Answer

Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.. Option B is correct because AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Answer

Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.

Answer

Use AWS Cost Explorer to filter by resource tags after they are manually applied.

Question 8

A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.

Answer

Amazon S3 cross-region replication

Answer

Amazon Kinesis Data Firehose

Answer

AWS Config

Question 9

A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which THREE steps are required to achieve this?

Accepted Answer

Create a new CloudTrail trail in the management account with organization trail enabled.. Option C is correct because enabling organization trail in the management account allows CloudTrail to automatically create a trail that logs events for all accounts in the AWS Organization, eliminating the need to manually enable CloudTrail in each member account. This is the only way to centrally collect CloudTrail logs from all accounts without individual account configuration.

Answer

Create an AWS Config rule to monitor CloudTrail configuration.

Answer

Apply a service control policy (SCP) to enforce CloudTrail logging.

Question 10

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

Accepted Answer

The Suspended account cannot be used until it is reactivated.. The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Answer

The Suspended account was invited to the organization.

Answer

The Production account is the management account.

Answer

The Management account was created directly.

Question 11

A company is designing a new application that will run on Amazon EKS. The application must be able to scale based on custom metrics such as number of messages in an SQS queue. Which Kubernetes component should be used to achieve this?

Accepted Answer

Kubernetes Event-Driven Autoscaler (KEDA). Kubernetes Event-Driven Autoscaler (KEDA) is the correct component because it is specifically designed to scale Kubernetes workloads based on external event sources like Amazon SQS queue depth. KEDA acts as a custom metrics adapter that integrates with the Kubernetes Horizontal Pod Autoscaler (HPA), allowing the application to scale pods dynamically based on the number of messages in the SQS queue, which is a custom metric not natively supported by the standard HPA.

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus

Answer

Kubernetes Cluster Autoscaler

Answer

AWS Auto Scaling with target tracking

Question 12

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Accepted Answer

Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.. Option B is correct because AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Answer

Enable CloudTrail to log all console logins and alert if MFA is not used.

Answer

Use a service control policy (SCP) to require MFA on all IAM users.

Question 13

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Accepted Answer

Enable CloudTrail organization trail from the management account.. Option A is correct because enabling an organization trail from the management account automatically creates a CloudTrail trail for all accounts in the AWS Organization, including future accounts, without requiring per-account configuration. This ensures centralized logging to a single S3 bucket and enforces compliance across the entire organization.

Answer

Create an AWS Lambda function in each account to enable CloudTrail.

Answer

Attach an SCP that requires CloudTrail to be enabled.

Answer

Create an AWS Config rule to detect accounts without CloudTrail.

Question 14

A company is migrating a legacy application to AWS. The application requires a relational database with read replicas for reporting. The company wants to minimize operational overhead. Which TWO database services meet these requirements?

Accepted Answer

Amazon Aurora. Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, combining the performance and availability of high-end commercial databases with the simplicity and cost-effectiveness of open-source databases. It supports up to 15 low-latency read replicas, which can be used for reporting workloads, and it automates time-consuming tasks such as hardware provisioning, database setup, patching, and backups, thereby minimizing operational overhead.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 15

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

Accepted Answer

Deploy an AWS Config conformance pack across accounts using AWS Organizations.. AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Answer

Use AWS CloudFormation StackSets in each account.

Answer

Create an AWS Lambda function in the management account to enable Config rules.

Answer

Use an SCP to require Config recording.

Question 16

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.. CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.

Answer

Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.

Answer

Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.

Answer

Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.

Question 17

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

Accepted Answer

Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.. Option D is correct because an SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Answer

Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

Answer

Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

Answer

Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

Question 18

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Accepted Answer

Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.. Option A is correct because defining a standardized set of tags and enforcing them with AWS Config rules ensures consistent cost allocation tagging across all accounts in AWS Organizations. AWS Config rules can evaluate resources for tag compliance and trigger remediation actions, such as automatically tagging resources or sending notifications, which is essential for accurate cost tracking. This approach aligns with the AWS Well-Architected Framework's cost optimization pillar by enabling granular cost allocation and chargeback.

Answer

Enable AWS-generated tags automatically for all resources.

Answer

Use service control policies (SCPs) to require tags on all resources.

Answer

Apply tags only at the resource creation time; they cannot be added later.

Question 19

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

Accepted Answer

Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Answer

Use AWS Lambda to re-enable GuardDuty if it is disabled.

Answer

Create an AWS Config rule to detect disabled GuardDuty and send alerts.

Answer

Attach an IAM policy to each user that denies guardduty:Disable* actions.

Question 20

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption. Option C is correct because a service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Answer

Use AWS CloudTrail to monitor and alert on bucket creation without encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Define an IAM policy in each account to deny S3:PutBucket without encryption