SAP-C02 Mock Exam 90 — 25 Questions

Question 1

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

Accepted Answer

Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.. Option C is correct because AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.

Answer

Use AWS Config to detect and delete untagged VPCs.

Answer

Use IAM policies in each account to require tags.

Answer

Use AWS CloudFormation StackSets to deploy VPC templates with tags.

Question 2

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.. AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer. Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).

Answer

Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.

Answer

Configure AWS IAM Identity Center to restrict access to approved Regions.

Answer

Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.

Question 3

A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.. Option A is correct because it combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.

Answer

Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.

Answer

Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.

Answer

Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.

Question 4

A company wants to centralize management of IAM users and groups across multiple AWS accounts. The solution should allow users to access resources in any account without needing separate credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and applications. It integrates with AWS Organizations to manage user and group permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Question 5

A company has a multi-account AWS environment with a central security account. They want to enable Amazon GuardDuty in all accounts and centrally view findings. The security team has already enabled GuardDuty in the security account and invited all member accounts. However, the security account is not receiving findings from all member accounts. Upon investigation, some member accounts show that GuardDuty is not enabled, and some show that they have not accepted the invitation. The team needs a scalable solution to enable GuardDuty across all accounts and ensure findings are sent to the security account. What should the team do?

Accepted Answer

Use the GuardDuty delegated administrator feature with AWS Organizations to automatically enable GuardDuty in all accounts and centralize findings.. Option D is correct because the GuardDuty delegated administrator feature integrated with AWS Organizations allows the security account to be designated as the GuardDuty administrator, which can then automatically enable GuardDuty for all existing and future member accounts in the organization. This eliminates the need for manual invitations and acceptances, ensuring that findings are centrally aggregated in the security account without requiring per-account configuration.

Answer

Use AWS Config rules to detect accounts without GuardDuty and send alerts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty resources in each account.

Answer

Use AWS Control Tower to enable GuardDuty in all accounts via a custom blueprint.

Question 6

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

Accepted Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.. Option D is correct because AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Answer

Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.

Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.

Answer

Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.

Question 7

A company is designing a multi-region active-active application with a relational database. The application requires strong consistency and read-after-write consistency globally. Which AWS database service should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is designed for multi-region active-active applications requiring strong consistency and read-after-write consistency. It uses a primary region for writes and replicates data to up to five secondary regions with typical latency under one second, while still providing global read-after-write consistency through its storage-based replication layer. This makes it the only AWS relational database service that meets the stated requirements for a multi-region active-active setup with strong consistency.

Answer

Amazon RDS for MySQL with Multi-AZ

Answer

Amazon DynamoDB Global Tables

Answer

Amazon ElastiCache for Memcached

Question 8

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CloudFormation Guard to validate templates before deployment.. Option C is correct because AWS CloudFormation Guard (cfn-guard) allows you to define rules that validate CloudFormation templates before deployment. You can create a rule that checks whether the `BucketEncryption` property is set on every `AWS::S3::Bucket` resource, preventing the creation of unencrypted buckets at the template level. This enforces encryption as a policy-as-code gate in the CI/CD pipeline.

Answer

Use an IAM permissions boundary for all IAM roles.

Answer

Use S3 Block Public Access at the account level.

Answer

Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled.

Question 9

A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create a customer-managed KMS key with a key policy that allows the consumer accounts to use the key.. Option A is correct because creating a customer-managed KMS key (CMK) with a key policy that explicitly grants the consumer accounts permission to use the key (e.g., via the `kms:Decrypt` and `kms:GenerateDataKey` actions) is required for cross-account encryption. This ensures that the S3 bucket can encrypt objects with the CMK, and consumer accounts can decrypt them using their own IAM permissions, meeting the security team's requirement for strict key control.

Answer

Use an SCP to require that all S3 buckets use server-side encryption with KMS.

Answer

Create IAM roles in each consumer account that grant access to the KMS key.

Question 10

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

Accepted Answer

Use AWS Config rules to detect public buckets and trigger an AWS Lambda function to make them private.. Option C is correct because AWS Config rules can continuously evaluate S3 bucket configurations against a custom or managed rule (e.g., 's3-bucket-public-read-prohibited'). When a bucket is detected as publicly accessible, the rule can invoke an AWS Lambda function via an Amazon CloudWatch Events event to automatically apply a bucket policy that removes public access, achieving automated remediation.

Answer

Use Amazon Inspector to scan for public buckets.

Answer

Use an SCP to deny making buckets public.

Answer

Use AWS CloudTrail to send alerts when a bucket becomes public.

Question 11

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.

Answer

Amazon Route 53 Resolver

Answer

Elastic Load Balancing (ELB)

Answer

Amazon Elastic Container Registry (ECR)

Question 12

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

Accepted Answer

Enable the RI discount sharing feature in the management account.. Option B is correct because enabling RI discount sharing in the management account allows all accounts in the AWS Organization to benefit from Reserved Instance discounts, which is essential for accurate cost allocation across departments. Without this, RI discounts would only apply to the purchasing account, skewing department-level cost tracking.

Answer

Enable detailed billing reports in the management account.

Answer

Enable AWS Cost and Usage Reports (CUR) for each member account.

Question 13

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones.. Option C is correct because launching EC2 instances in at least two Availability Zones (AZs) ensures that if one AZ fails, the application continues to run from the other AZ, providing fault tolerance and high availability. Option D is correct because configuring the ALB to be internet-facing and registering instances from multiple AZs allows the ALB to distribute incoming traffic across healthy instances in different AZs, automatically rerouting traffic if an AZ becomes impaired.

Answer

Use an Auto Scaling group to launch instances only in one Availability Zone.

Answer

Use a Network Load Balancer instead of ALB for better performance.

Answer

Launch all EC2 instances in a single Availability Zone for low latency.

Question 14

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

Accepted Answer

Use a Service Control Policy (SCP) in AWS Organizations that denies s3:CreateBucket if the request does not include the required tags.. Option C is correct because a Service Control Policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action if the request does not include the required tags (cost center and environment). SCPs apply to all accounts in the organization, enforcing the tagging requirement at the API level before the bucket is created, which is the most effective preventive control.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template with tags.

Answer

Use IAM policies in each account to require tags on bucket creation.

Answer

Use AWS Config rules to automatically tag buckets after creation.

Question 15

A multinational corporation is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have server-side encryption enabled, and any new bucket created without encryption must be automatically remediated. Which TWO steps should the team take to achieve this? (Choose two.)

Accepted Answer

Use a CloudWatch Events rule to trigger a Lambda function that enables encryption on any new bucket. Option C is correct because a CloudWatch Events rule (now Amazon EventBridge) can detect the 'CreateBucket' API call and trigger an AWS Lambda function that automatically enables server-side encryption on the newly created bucket. This provides real-time, event-driven remediation without manual intervention, ensuring compliance immediately after bucket creation.

Answer

Use an IAM policy to deny s3:PutBucketEncryption without encryption settings

Answer

Use AWS Trusted Advisor to check bucket encryption and send alerts

Answer

Use AWS Config with a managed rule to detect non-compliant buckets and an auto-remediation action

Question 16

A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct choice because it is a managed service that enables you to create, store, and control encryption keys used to encrypt data at rest and in transit. KMS integrates with other AWS services (e.g., S3, EBS, RDS) and supports envelope encryption, where a customer master key (CMK) encrypts data keys that perform the actual encryption. It also provides automatic key rotation and fine-grained access control via IAM policies and key policies, meeting the requirement for AWS-managed keys.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 17

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records all AWS API calls made in an account, capturing the who, what, when, and source IP for every action. To centralize these logs from multiple accounts into a single location, you can configure CloudTrail to deliver log files to a centralized Amazon S3 bucket, and then use Amazon CloudWatch Logs to monitor, search, and alert on those API events in real time. Together, they provide a complete, centralized logging and monitoring solution for API activity across a multi-account environment.

Answer

Amazon GuardDuty

Answer

Amazon S3

Answer

AWS Config

Question 18

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

Accepted Answer

Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.. AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.

Answer

Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.

Answer

Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.

Question 19

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

Accepted Answer

The SCP denies all services not explicitly allowed, and EC2 is not on the whitelist. The SCP uses a deny-all approach with a whitelist of allowed services. Since EC2 is not on that whitelist, the SCP implicitly denies all EC2 actions, overriding any IAM policy that explicitly allows ec2:RunInstances. SCPs act as a guardrail that cannot be bypassed by account-level IAM policies.

Answer

The IAM role used by the DevOps team has a trust policy that does not allow EC2 actions

Answer

The EC2 service has been disabled via AWS Config in that account

Answer

The development account is in an organizational unit (OU) with a different SCP that denies EC2

Question 20

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

Accepted Answer

Users from 10.0.0.0/16 can access objects in the confidential/ prefix, but users from 192.168.0.0/16 cannot.. The S3 bucket policy includes an explicit Deny statement that blocks all S3 actions on the 'confidential/' prefix unless the request originates from the 10.0.0.0/16 IP range. Since explicit Deny statements override any Allow statements in AWS IAM policy evaluation, users from 192.168.0.0/16 are denied access to the 'confidential/' prefix even though the GetObject Allow statement includes that range. Only users from 10.0.0.0/16 satisfy the condition in the Deny statement and can therefore access objects in the 'confidential/' prefix.

Answer

Users from 192.168.0.0/16 can access objects in the confidential/ prefix.

Answer

Users from 10.0.0.0/16 cannot access objects in the confidential/ prefix.

Answer

The policy has no effect because the Allow and Deny statements cancel each other.