SAP-C02 Design Solutions for Organizational Complexity — 15 Questions

Question 1

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

Accepted Answer

Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.. Option C is correct because SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Answer

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Answer

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Answer

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Question 2

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.

Question 3

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.. AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Answer

Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

Answer

Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

Answer

Use an SCP to require CloudTrail to be enabled in each account.

Question 4

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Accepted Answer

The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.. Option C is correct because the S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Answer

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Answer

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Answer

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Question 5

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

Accepted Answer

An SCP that denies the effect of actions that modify billing preferences.. Option D is correct because a Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Answer

An SCP that allows only read-only billing actions.

Answer

An SCP that denies all billing-related actions except read-only.

Answer

An IAM policy attached to the root OU that denies billing modifications.

Question 6

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.

Question 7

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Accepted Answer

Use an SCP to prevent disabling of AWS Config in any account.. Option B is correct because AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Answer

Manually create an S3 bucket in each account to store Config logs.

Answer

Create an IAM role in each account to allow the management account to access Config logs.

Question 8

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

Accepted Answer

The user is not passing the MFA serial number and token code in the assume-role API call.. Option C is correct because the IAM role trust policy includes a condition that checks for the presence of both `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge`. Even though the user has MFA enabled and is passing the MFA token, the `aws:MultiFactorAuthSerialNumber` and `aws:MultiFactorAuthTokenCode` parameters must be explicitly included in the `sts:AssumeRole` API call. Without these, the condition evaluates to false, resulting in an 'AccessDenied' error.

Answer

The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.

Answer

The role requires MFA, but the user's MFA device is not configured correctly.

Answer

The principal is set to the root account, which does not allow IAM users to assume the role.

Question 9

Refer to the exhibit. A company runs the AWS CLI command to list accounts in AWS Organizations. The company wants to remove the account '444444444444' from the organization. What must the company do first before it can remove this account?

Accepted Answer

Remove the account's payment method.. Option C is correct because, before an AWS account can be removed from an AWS Organization, the account must have its payment method removed. This is a prerequisite enforced by AWS to ensure the account is not left in a state where it cannot be billed independently after leaving the organization. The management account cannot directly remove an account that still has an active payment method associated with it.

Answer

Close the AWS account from the management account.

Answer

Create a support ticket to AWS to remove the account.

Answer

The management account can directly remove the account without any prerequisites.

Question 10

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.. Option A is correct because AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Answer

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Answer

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Answer

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Question 11

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Accepted Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.. Option A is correct because the `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to traffic originating from specific VPC endpoints (interface or gateway endpoints). This ensures that only requests coming through approved VPC endpoints can access the data lake, directly enforcing the mandate that access must originate from approved VPCs.

Answer

Enable S3 Block Public Access at the account level.

Answer

Use AWS Certificate Manager to issue certificates for S3 bucket access.

Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.

Question 12

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Answer

AWS Config rules with auto-remediation

Answer

AWS Service Catalog with a portfolio of approved AMIs

Answer

AWS Identity and Access Management (IAM) policies in each account

Question 13

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.. Option D is correct because AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Answer

Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.

Answer

Set up AWS Direct Connect gateway and route all traffic through the security account.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.

Question 14

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

Accepted Answer

Apply tags to resources and enable cost allocation tags in Billing and Cost Management.. Option C is correct because applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Answer

Use Cost Explorer to filter by linked account, which automatically groups by business unit.

Answer

Use AWS Budgets to create budgets per account and manually aggregate.

Answer

Create a separate payer account for each business unit.

Question 15

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

Accepted Answer

Use an SCP to deny the iam:UpdateAccountPasswordPolicy action and deploy a password policy using CloudFormation StackSets.. Option B is correct because an SCP can deny the iam:UpdateAccountPasswordPolicy action, preventing member accounts from altering the password policy, while CloudFormation StackSets can deploy a compliant password policy across all member accounts automatically. This combination provides a preventive control that enforces the minimum 14-character requirement without relying on user action or reactive detection.

Answer

Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

Answer

Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

Answer

Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.