SAP-C02 Mock Exam 86 — 25 Questions

Question 1

An organization uses AWS Organizations with a multi-account strategy. The security team needs to ensure that all accounts must use AWS CloudTrail with logs delivered to a centralized S3 bucket. They also want to receive notifications if any account disables CloudTrail. What is the MOST efficient solution?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Use an S3 event notification on the centralized bucket to trigger a Lambda function that sends an SNS alert if logs stop arriving.. Option A is correct because it combines a preventive control (SCP) to block CloudTrail disabling actions with a detective control (S3 event notification + Lambda + SNS) to alert if logs stop arriving. The SCP ensures that even if an account has administrative privileges, it cannot stop or delete the trail, while the S3 event notification on the centralized bucket detects the absence of new log files, triggering an alert. This is the most efficient solution as it requires minimal overhead and provides both enforcement and notification.

Answer

Use AWS CloudTrail to log management events and set up a CloudWatch Events rule that triggers on StopLogging API calls.

Answer

Use an SCP that requires all accounts to have a specific trust policy for CloudTrail. Use CloudTrail Insights to detect anomalous activity.

Answer

Deploy a Lambda function in each account that periodically checks CloudTrail status and sends an SNS message if disabled.

Question 2

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

Accepted Answer

Use tag policies in AWS Organizations to enforce tagging on new resources. Option B is correct because tag policies in AWS Organizations allow you to define a set of tagging rules that are enforced across all accounts in the organization. When a tag policy is attached to an organizational root, OU, or account, AWS automatically prevents the creation of resources that do not comply with the specified tags, ensuring that all new resources are tagged correctly from the start without requiring manual remediation or custom scripts.

Answer

Use AWS Config rules to identify untagged resources and send alerts

Answer

Attach an SCP that denies all actions if the resource does not have the cost center tag

Answer

Create a Lambda function that runs daily to tag untagged resources

Question 3

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

Accepted Answer

Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.. Option B is correct because it uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Answer

Use AWS PrivateLink to route traffic through the NGFW.

Answer

Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Set up AWS Direct Connect between all VPCs and the inspection VPC.

Question 4

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Answer

Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.

Answer

Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.

Answer

Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.

Question 5

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that is enabled for all accounts. Option C is correct because AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Answer

Configure each account's CloudTrail to send logs to a central CloudWatch Logs group

Answer

Create a CloudTrail trail in each account and deliver logs to the same S3 bucket

Answer

Use S3 replication to copy logs from individual account buckets to a central bucket

Question 6

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

Accepted Answer

Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. Option C is correct because AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Answer

Create VPC peering connections between all VPCs and use security groups for inspection

Answer

Configure a VPN between each VPC and a central virtual appliance

Answer

Use AWS Direct Connect to connect all VPCs to a common router

Question 7

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

Accepted Answer

Use the management account to designate the member account as a delegated administrator for IAM Identity Center.. To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Answer

Enable AWS Organizations and create an admin role in the member account.

Answer

Create a new OU for the delegated administrator account.

Answer

Attach an SCP to allow IAM Identity Center actions in the member account.

Question 8

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

Accepted Answer

Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.. Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Answer

Use Amazon QuickSight to create dashboards from the flow logs.

Answer

Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

Answer

Load the flow logs into Amazon Redshift and run SQL queries.

Question 9

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

Accepted Answer

Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center. To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Answer

Create an IAM role in the member account with permissions to manage Identity Center

Answer

Attach an SCP to the member account allowing Identity Center actions

Answer

Create a new user in the management account with admin privileges

Question 10

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

Accepted Answer

Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.. Option A is correct because it uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Answer

Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.

Answer

Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.

Answer

Share the EC2 console credentials of each account with the DevOps team.

Question 11

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.. Option C is correct because an IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Answer

Create a service control policy in AWS Organizations that restricts instance types for all accounts.

Answer

Use AWS Config to automatically terminate instances that are not of allowed types.

Answer

Configure an S3 bucket policy that only allows specific instance types to be used.

Question 12

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

Accepted Answer

The instance is running and has passed its status checks.. The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot. However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Answer

The instance is pending.

Answer

The instance is stopped.

Answer

The instance is terminated.

Question 13

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.. Option A is correct because AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Answer

Use AWS Service Catalog to enforce tagging on EC2 products.

Answer

Use AWS Resource Access Manager to share a tagging policy across accounts.

Answer

Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

Question 14

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

Accepted Answer

Set up S3 cross-account replication from each account's bucket to the central bucket. Option B is correct because S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Answer

Use a Lambda function in each account to copy logs to the central bucket

Answer

Configure VPC Flow Logs in each account to directly deliver to the central bucket

Answer

Use CloudWatch Logs subscription filter to stream logs to the central account

Question 15

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

Accepted Answer

Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account. Option D is correct because AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.

Answer

Establish VPC peering between the shared services VPC and each developer VPC

Answer

Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account

Answer

Use AWS Systems Manager to automate domain join with a custom document

Question 16

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon RDS

Question 17

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Accepted Answer

AWS CloudTrail can be configured to log management events across all accounts from the management account.. Option C is correct because AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Answer

Accounts cannot be moved between OUs once created.

Answer

Each organizational unit (OU) should contain only one account for security isolation.

Answer

SCPs can only be applied to root accounts, not OUs.

Question 18

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

Accepted Answer

Share the portfolio with the target accounts from the Service Catalog console. Option A is correct because AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Answer

Use AWS CloudFormation StackSets to deploy products to each account

Answer

Use SCPs to allow specific accounts to use Service Catalog

Answer

Create IAM roles in the central account that developers can assume

Question 19

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

Accepted Answer

Attach an IAM policy to the user that allows s3:GetObject on the bucket.. Option C is correct because the simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Answer

Create an IAM role in the source account and have the user assume it.

Answer

Update the bucket policy to allow the user's ARN directly.

Answer

Use a bucket ACL to grant access to the user's canonical ID.

Question 20

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

Accepted Answer

The users are operating in the management account.. SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Answer

The SCP is attached to the root, not the OU.

Answer

The users have a permissions boundary that allows the actions.

Answer

The SCP's condition key does not match the actual tag.