SAP-C02 Mock Exam 89 — 25 Questions

Question 1

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.. AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Answer

Use AWS Config rules to enforce the IAM role creation in each account.

Answer

Manually create the IAM role in each account using the AWS Management Console.

Answer

Use AWS Organizations to create the IAM role via a service control policy (SCP).

Question 2

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.. Option D is correct because AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Answer

Use AWS Single Sign-On (SSO) to grant the audit team access to each account.

Answer

Create an IAM user in the audit account and allow that user to assume a role in each account.

Answer

Manually create an IAM role in each account and attach a read-only policy.

Question 3

A company uses AWS Organizations with hundreds of accounts. They want to centrally manage VPC security group rules to ensure that only approved CIDR ranges are allowed for SSH access. Which solution is MOST scalable and auditable?

Accepted Answer

Use AWS CloudFormation StackSets to deploy security groups with approved rules, and use an SCP to deny creation or modification of security groups outside of CloudFormation.. Option D is correct because it combines CloudFormation StackSets for deploying approved security groups across hundreds of accounts with an SCP that denies ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress actions unless they originate from CloudFormation (using the aws:ViaAWSService condition key). This ensures that only centrally managed, auditable deployments can create or modify security groups, providing both scalability and a clear audit trail via CloudFormation change sets and StackSet operations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remove the offending rules.

Answer

Create an SCP that denies ec2:AuthorizeSecurityGroupIngress for SSH ports unless the CIDR is in an approved list.

Answer

Use AWS Firewall Manager to centrally manage security group rules across accounts.

Question 4

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Answer

AWS Key Management Service (KMS)

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A company is using a multi-account strategy with AWS Organizations. The security team discovers that an SCP intended to block access to non-compliant AWS regions is not working. The SCP is attached to the root OU. When a user in a member account attempts to launch an EC2 instance in a blocked region, the request succeeds. What is the most likely cause?

Accepted Answer

The user belongs to the management account, and SCPs do not apply to the management account.. SCPs do not apply to the management account of an AWS Organizations hierarchy. Since the user belongs to the management account, the SCP attached to the root OU has no effect on their actions, allowing the EC2 launch in a blocked region to succeed.

Answer

The IAM policy of the user overrides the SCP.

Answer

The SCP is not attached to the member account's OU.

Answer

The SCP is missing an explicit allow statement for the regions.

Question 6

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. Option B is correct because AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 7

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

Accepted Answer

Create an AWS Service Catalog product that uses AWS Organizations APIs to create a new account, applies a baseline CloudFormation template, and moves the account to the correct OU.. Option A is correct because it uses AWS Service Catalog to provide a self-service portal for the development team, while the central IT team retains governance by embedding AWS Organizations API calls to create accounts, apply a baseline CloudFormation template for security and compliance, and automatically move the account to the correct Organizational Unit (OU). This approach enforces guardrails without granting direct management account access.

Answer

Use AWS CloudFormation StackSets to create accounts in bulk.

Answer

Use the AWS Organizations console to manually create accounts and assign them to the appropriate OU.

Answer

Give the development team the credentials to the management account and let them create accounts directly.

Question 8

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

Accepted Answer

Use AWS Cost Categories to group costs by tag value and set a default rule for untagged resources.. Option D is correct because AWS Cost Categories allow you to group costs by tag values and, crucially, set a default rule for untagged resources. This ensures that all resources—tagged or not—are assigned to a cost center, providing the most accurate cost allocation across the entire organization. Other options only filter or report on tagged resources, leaving untagged costs unallocated.

Answer

Enable cost allocation tags and use AWS Cost Explorer to filter by tag.

Answer

Create AWS Budgets reports for each cost center using tag filters.

Answer

Export AWS Cost and Usage Reports to Amazon QuickSight and use tag-based filtering.

Question 9

A large enterprise is migrating to AWS and wants to implement a multi-account strategy with centralized network connectivity. The company has multiple VPCs in various accounts that need to communicate with each other and with on-premises resources. The solution must be scalable and minimize operational overhead. Which design should be used?

Accepted Answer

Use an AWS Transit Gateway in a central network account and attach all VPCs from the various accounts.. Option D is correct because AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks, enabling scalable, low-operational-overhead connectivity across multiple accounts. By placing the Transit Gateway in a central network account and using AWS Resource Access Manager to share it with other accounts, the enterprise can avoid the complexity of managing many individual connections while supporting transitive routing and centralized control.

Answer

Use AWS PrivateLink to connect VPCs via interface endpoints.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Set up a VPN connection from each VPC to the on-premises network and use routing to enable inter-VPC communication.

Question 10

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

Accepted Answer

The write is allowed because the policy grants access to the root of account 123456789012.. The S3 bucket policy grants access to the root user of account 123456789012 (the `Principal` is the AWS account root user via the account ARN). When a service in that account writes to the bucket, the request is made on behalf of the account, and the root user effectively owns all identities in the account. The policy allows `s3:PutObject` on the `AWSLogs/123456789012/*` prefix, so the write to `s3://my-log-bucket/AWSLogs/123456789012/logfile.txt` is permitted. Option B correctly identifies that the root user grant covers the service's action.

Answer

The write is denied because the principal is the root user, not an IAM role.

Answer

The write is denied because the policy only allows GetObject, not PutObject.

Answer

The write is allowed only if the object key is exactly 'AWSLogs/123456789012/'.

Question 11

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

Accepted Answer

Enable Security Hub in the central account and invite member accounts to enable Security Hub.. Option D is correct because AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Answer

Set up Amazon EventBridge to forward findings from each account to the central account.

Answer

Use Amazon CloudWatch cross-account dashboards to view findings.

Answer

Enable AWS Config aggregator in the central account.

Question 12

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

Accepted Answer

Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.. Option B is correct because AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Answer

Use S3 access points in each account to grant access to the central bucket.

Answer

Create an S3 interface endpoint in the logging account and share it with other accounts.

Answer

Copy logs to each account's own S3 bucket and run Athena queries locally.

Question 13

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

Accepted Answer

SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.. Option D is correct because SCPs are evaluated before the actual API call, but they cannot see the current state of the bucket. The SCP denies the PutBucketVersioning action only if the condition checks for the current setting, but SCPs cannot access the bucket's current configuration. Therefore, the SCP as described would not block the action. Option A is wrong because SCPs apply to all users. Option B is wrong because SCPs are not optional. Option C is wrong because SCPs do not require explicit allow.

Answer

The SCP is overridden by a service control policy that allows the action.

Answer

The SCP does not have an explicit deny; it uses a default deny.

Answer

The SCP is not applied to the root organizational unit.

Question 14

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Deploy an AWS Transit Gateway and attach all VPCs (business unit and shared services) to it.. AWS Transit Gateway acts as a hub-and-spoke router, allowing all VPCs (business units and shared services) to connect through a single gateway. This minimizes latency by using the AWS global network backbone and maximizes throughput with up to 50 Gbps per VPC attachment, scaling horizontally across multiple attachments. It simplifies management compared to mesh peering and avoids the bandwidth limitations of VPN or PrivateLink for inter-VPC routing.

Answer

Create a VPN connection from each business unit VPC to the shared services VPC.

Answer

Use AWS PrivateLink to connect services in the shared services VPC to the business unit VPCs.

Answer

Set up VPC peering between each business unit VPC and the shared services VPC.

Question 15

A global company with 50 AWS accounts uses AWS Organizations and wants to centralize CloudTrail logs. The security team requires that all accounts send their CloudTrail logs to a central S3 bucket in the audit account. Which combination of steps will ensure this?

Accepted Answer

Create a CloudTrail trail in the audit account with an S3 bucket, and add a bucket policy that grants cross-account permissions for each member account to deliver logs. Then configure each member account to use the same trail.. Option D is correct because it uses a single CloudTrail trail in the audit account with a central S3 bucket, and the bucket policy grants the necessary s3:PutObject permissions to each member account's CloudTrail service principal. Each member account then configures CloudTrail to use the same trail (the audit account's trail), which allows CloudTrail to deliver logs from all accounts to the central bucket without requiring separate trails or manual log forwarding.

Answer

Use AWS Config to forward logs to a central S3 bucket.

Answer

Enable CloudTrail in each account and use AWS Organizations to aggregate logs.

Answer

Create a CloudTrail trail in the audit account that logs all accounts via CloudWatch Logs.

Question 16

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

Accepted Answer

Apply an SCP that denies all actions if the principal does not have MFA.. Option D is correct because Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor and disable users without MFA.

Answer

Set an IAM password policy that requires MFA for all users.

Question 17

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

Accepted Answer

The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.. The bucket policy explicitly grants access to the member account's root user ARN (e.g., `arn:aws:iam::123456789012:root`). When a developer assumes an IAM role in the member account, the resulting session has a different ARN (e.g., `arn:aws:sts::123456789012:assumed-role/DevRole/session`). Because the bucket policy's Principal is restricted to the root user ARN, the role session is not recognized as a matching principal, and access is denied. This is a common misconfiguration when mixing root user grants with assumed-role access.

Answer

The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.

Answer

The bucket policy requires an explicit Deny for all principals except the root user.

Answer

A service control policy (SCP) is denying access to the S3 bucket.

Question 18

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

Accepted Answer

Use AWS Organizations to define a tag policy that mandates the cost center tag.. Option A is correct because AWS Organizations tag policies allow you to define rules for tagging resources across accounts in your organization. By specifying the cost center tag as mandatory in a tag policy, you can enforce that all resources must have this tag, and any non-compliant resources can be reported or prevented from being created, depending on the policy's enforcement mode.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.

Answer

Enable AWS Cost Explorer to report on untagged resources.

Question 19

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

Accepted Answer

Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.. Option A is correct because deploying the pipeline in a central DevOps account and using cross-account IAM roles to deploy to target accounts follows the principle of least privilege and centralizes management. This approach avoids duplicating resources, ensures a single source of truth for the source repository and artifact store, and scales easily as new accounts are added via AWS Control Tower. Cross-account IAM roles allow the pipeline to assume a role in each target account with scoped permissions, eliminating the need for long-term credentials.

Answer

Create a separate pipeline in each account using the same source repository.

Question 20

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a bucket in the logging account with a KMS key. Grant the necessary permissions to the VPC Flow Logs service in each account to write to that bucket using the KMS key. Enable VPC Flow Logs in each account to publish to the central bucket.. Option B is correct because it uses a central S3 bucket in the logging account with a customer-managed KMS key, which satisfies the encryption-at-rest requirement. By granting the VPC Flow Logs service principal in each account the necessary permissions to write to the central bucket and use the KMS key, logs are delivered directly without additional infrastructure. This approach minimizes operational overhead by avoiding replication, streaming services, or per-account bucket management.

Answer

Create a bucket in the logging account with default S3-managed encryption and enable VPC Flow Logs in each account to publish to that bucket.

Answer

Create a bucket in each account with KMS encryption and use S3 Cross-Region Replication to copy logs to the central bucket.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket with KMS encryption.