SAP-C02 Mock Exam 88 — 25 Questions

Question 1

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Accepted Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.. Option D is correct because it uses a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action unless a specific tag is present. This enforces the desired AWS Config rule indirectly by preventing any action that would disable or bypass the public access block, and it applies automatically to all new accounts in the organization with minimal overhead—no per-account deployment or configuration is needed.

Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Question 2

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Option B is correct because using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 3

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

Accepted Answer

Use attribute-based access control (ABAC) with IAM Identity Center and session tags from Active Directory.. Option C is correct because it uses attribute-based access control (ABAC) with IAM Identity Center, which allows permissions to be dynamically granted based on user attributes (e.g., job function) passed as session tags from Active Directory. This approach scales seamlessly as users and accounts grow, since policies reference tags rather than individual users or groups, and it centralizes identity management without requiring per-account role updates.

Answer

Create a permission set in IAM Identity Center for each job function and assign to appropriate groups.

Answer

Use AWS Organizations to attach SCPs that grant permissions based on user tags.

Answer

Use IAM roles directly in each account and manage trust policies centrally.

Question 4

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.. Option C is correct because a service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Answer

Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

Answer

Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

Question 5

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

Accepted Answer

Deny effect with ec2:* and rds:* as the actions.. Option D is correct because AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Answer

Deny effect with "*" as the action.

Answer

Deny effect with NotAction set to ec2:* and rds:*.

Answer

Allow effect with ec2:* and rds:* as the actions.

Question 6

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Accepted Answer

Centrally enforce policies using service control policies (SCPs).. Service control policies (SCPs) allow you to centrally manage permissions for all accounts in your AWS Organizations hierarchy. SCPs act as a guardrail, enabling you to define the maximum available permissions for IAM roles and users across member accounts without granting any permissions themselves. This ensures consistent enforcement of security and compliance policies across the entire organization.

Answer

Automatically create VPC peering connections between accounts.

Answer

Simplify cross-region replication for Amazon RDS databases.

Answer

Reduce the total cost of EC2 instances by aggregating usage across accounts.

Question 7

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

Accepted Answer

Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.. Option C is correct because AWS Config rules can be deployed across all accounts via AWS Organizations, and the custom remediation action can disable access keys. Option A is wrong because IAM Access Analyzer does not manage MFA. Option B is wrong because SCPs cannot enforce MFA on existing users; they can deny access if MFA is not present, but they cannot disable keys. Option D is wrong because AWS IAM Identity Center is for workforce identity, not for managing existing IAM users.

Answer

Create an SCP that denies all API calls if the user does not have an MFA device.

Answer

Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.

Answer

Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.

Question 8

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Accepted Answer

Designate a delegated administrator account for GuardDuty in AWS Organizations.. Option C is correct because designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Answer

Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.

Answer

Create a new S3 bucket in each account to store GuardDuty findings.

Question 9

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.. Option C is correct because AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Answer

Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

Answer

Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

Answer

Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

Question 10

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Accepted Answer

Use AWS Resource Access Manager to share resources only with trusted accounts.. Option B is correct because AWS Resource Access Manager (RAM) enables you to share resources such as subnets, transit gateways, and License Manager configurations only with specific AWS accounts or organizational units, which directly supports a data perimeter by preventing unintended cross-account access. Option C is correct because Service Control Policies (SCPs) can be applied at the organization root, OU, or account level to deny access to external AWS accounts unless explicitly allowed, effectively creating a boundary that prevents data exfiltration to unauthorized accounts.

Answer

Disable public access to all S3 buckets and restrict cross-account access.

Answer

Use VPC endpoints for all AWS services and ensure they are private.

Answer

Use security groups to restrict outbound traffic to known IP addresses.

Question 11

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Accepted Answer

To ensure that only requests originating from accounts within the specified organization are allowed.. The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Answer

To restrict access to only the root user of the management account.

Answer

To enforce that all requests are made using HTTPS.

Answer

To allow access only from specific IP addresses within the organization.

Question 12

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Accepted Answer

Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.. Option B is correct because AWS IAM Identity Center can use AWS Managed Microsoft AD as its identity source, enabling seamless synchronization of users and groups from an existing on-premises Active Directory via a two-way forest trust. This eliminates the need for manual import and provides a managed, highly available directory service that integrates directly with IAM Identity Center for single sign-on across multiple AWS accounts.

Answer

Create an IAM Identity Center identity store and manually import users from Active Directory.

Answer

Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.

Answer

Configure AWS CloudTrail to log all sign-in events.

Question 13

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon S3 Select to retrieve only the relevant log entries based on the IP address and time range.. Amazon S3 Select allows you to retrieve only a subset of data from an object using SQL expressions, making it highly cost-effective for scanning large log files for specific IP addresses and time ranges. It reduces the amount of data transferred and processed compared to reading the entire object, and it scales automatically without provisioning any infrastructure. This approach is ideal for ad-hoc queries on structured or semi-structured log data stored in S3.

Answer

Use Amazon Athena to query the logs directly in S3.

Answer

Stream the logs to Amazon OpenSearch Service for real-time querying.

Answer

Use AWS Glue to catalog the logs and query with Amazon Redshift Spectrum.

Question 14

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

Network Load Balancer. Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and can distribute incoming traffic across multiple EC2 instances in an Auto Scaling group with extremely low latency and high throughput. It is ideal for applications that require handling millions of requests per second while preserving the source IP address of clients.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 15

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

Accepted Answer

Attach an SCP that denies the restricted instance types to the OU.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Answer

Use AWS CloudTrail to monitor and alert when restricted instance types are launched.

Answer

Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.

Answer

Attach an SCP to the root of the organization and exclude the management account.

Question 16

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

Accepted Answer

Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.. Option A is correct because it uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Answer

Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

Answer

Use the root user of each account to access the buckets.

Answer

Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

Question 17

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.. AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Answer

Manually enable Shield Advanced in each account after creation.

Answer

Use AWS Config to detect accounts without Shield Advanced and send notifications.

Answer

Use AWS Organizations to create an SCP that requires Shield Advanced.

Question 18

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

Accepted Answer

Enable AWS CloudTrail in the master account and log sts:AssumeRole events.. Option A is correct because AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Answer

Create an IAM Access Analyzer in each member account to monitor cross-account access.

Answer

Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

Answer

Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.

Question 19

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

Accepted Answer

Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.. AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Answer

Use an SCP that denies all IAM actions except those from a specific admin account.

Answer

Use an IAM password policy that requires multi-factor authentication for all users.

Answer

Create an IAM role in each account with full administrator access and use a break-glass process to assume it.

Question 20

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

Accepted Answer

AWS IAM Identity Center.. AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

Amazon Cognito user pools.

Answer

AWS Identity and Access Management (IAM) with SAML federation.