SAP-C02 Design Solutions for Organizational Complexity — 30 Questions

Question 1

Refer to the exhibit. A company runs the AWS CLI command to list accounts in AWS Organizations. The company wants to remove the account '444444444444' from the organization. What must the company do first before it can remove this account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Close the AWS account from the management account.. To remove a member account from an AWS Organization, the management account must first close the account if it was created within the organization. This is a prerequisite because accounts created via Organizations cannot be removed directly; only invited accounts can be removed without closing. Closing the account initiates the removal process, and the account becomes a standalone account with billing resolved.

Answer

Create a support ticket to AWS to remove the account.

Answer

Remove the account's payment method.

Answer

The management account can directly remove the account without any prerequisites.

Question 2

A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?

Accepted Answer

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.. It uses cross-Region transit gateway peering, which allows VPCs in different Regions to communicate through their respective transit gateways. By attaching both VPCs to their local transit gateways and peering those gateways, you can configure route tables to force AD traffic through the inspection VPC in one Region, satisfying the firewall inspection requirement. Option D is incorrect because you cannot attach a VPC in a secondary Region to a transit gateway in the primary Region; transit gateway attachments are regional.

Answer

Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.

Answer

Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.

Answer

Deploy AD in two Regions, attach both VPCs to a transit gateway in the primary Region, and use a transit gateway inter-Region peering attachment. Configure route tables to force traffic through the inspection VPC in the primary Region.

Question 3

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.. It uses AWS Config rules to detect noncompliant S3 buckets (e.g., missing versioning or KMS encryption) and triggers an automated Lambda remediation to enable versioning and encryption. This ensures compliance with minimal manual intervention, though it does incur some operational overhead for Lambda maintenance. Option A is incorrect because SCPs cannot enforce versioning at bucket creation—versioning is enabled after creation via PutBucketVersioning, and the headers mentioned in the explanation do not exist. Option B only alerts and does not enforce. Option C is not scalable for OU-level enforcement and can be bypassed.

Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Question 4

A company uses AWS Organizations with multiple OUs. The security team wants to prevent all accounts in the 'Production' OU from using non-compliant EC2 instance types, but allow exceptions for specific accounts. Which combination of controls should be used?

Accepted Answer

Use resource tags to identify compliant instances and enforce via IAM conditions.. Using resource tags combined with IAM conditions in Service Control Policies (SCPs) allows enforcement at the OU level while enabling exceptions. A Deny SCP can be attached to the Production OU that denies ec2:RunInstances for non-compliant instance types unless the resource has a specific tag (e.g., 'Compliant: true'). Exception accounts can then tag their instances with the required tag to bypass the denial. This approach effectively uses IAM condition keys within an SCP, not IAM policies attached to accounts, and provides a scalable mechanism for exceptions.

Answer

Use AWS Config rules to mark non-compliant instances and use AWS Lambda to terminate them.

Answer

Use IAM policies to deny non-compliant instance types for the Production OU, and attach a different IAM policy to exception accounts.

Answer

Use an SCP to deny non-compliant instance types at the OU level, and use resource-based policies on exception accounts to allow them.

Question 5

A company has multiple AWS accounts and wants to centralize logging from all accounts to a single S3 bucket in a logging account. The logs must be encrypted with a KMS key managed by the logging account. What is the MOST secure way to allow cross-account S3 server access logs?

Accepted Answer

Use a bucket policy in the logging account that grants the S3 log delivery service principal access to write objects, and configure the KMS key policy to allow the log delivery service to use the key.. S3 server access logs are delivered by the S3 log delivery service, which operates under the service principal `log-delivery.log.amazonaws.com`. To allow cross-account log delivery to a KMS-encrypted bucket, the bucket policy must grant `s3:PutObject` to that service principal, and the KMS key policy must grant `kms:GenerateDataKey` and `kms:Decrypt` to the same service principal. This ensures the logging account retains full control of the key while enabling secure, auditable log delivery from any source account.

Answer

Set the bucket policy to allow the source accounts to write logs, and enable default encryption on the bucket with the KMS key.

Answer

Create an IAM role in the logging account and allow the source accounts to assume it, then configure the source accounts to use that role for logging.

Answer

Configure the logging account's KMS key with a policy that allows the S3 service to use it, and set the bucket policy to allow the source accounts to write logs.

Question 6

A company is using AWS Organizations with hundreds of accounts. They need to ensure that no account can modify the VPC default security group. Which SCP should they apply to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroup*","Resource":"*"}]}. Which denies all ec2:ModifySecurityGroup* actions on any security group. This ensures that no account can modify the default security group, as required. Option C is incorrect because it only denies the ec2:ModifySecurityGroupRules action and uses a condition that applies to all VPCs, not specifically the default security group. Option A only prevents deletion, not modification. Option D prevents creation but not modification.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:DeleteSecurityGroup","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroupRules","Resource":"arn:aws:ec2:*:*:security-group/*","Condition":{"StringEquals":{"ec2:Vpc":"arn:aws:ec2:*:*:vpc/*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateSecurityGroup","Resource":"*"}]}

Question 7

A company uses AWS Organizations with a policy that denies access to services unless they are explicitly allowed. The security team wants to allow only approved services. What type of policy should they use?

Accepted Answer

Use an SCP with a Deny effect for all services except approved ones.. To implement a deny-by-default model where only approved services are allowed, you need a policy that denies all services except those explicitly approved. An SCP with a Deny effect for all services except approved ones effectively creates a whitelist. Option C is incorrect because it only denies specific unapproved services, leaving all other unapproved services allowed by default, which does not achieve the goal of only allowing approved services.

Answer

Use an SCP with an Allow effect for approved services.

Answer

Use an SCP with a Deny effect for unapproved services.

Answer

Use an IAM policy with a Deny effect for unapproved services.

Question 8

A company is using AWS Organizations with multiple OUs. The security team wants to ensure that no account can delete CloudTrail trails or S3 bucket policies. Which THREE SCP strategies should be combined?

Accepted Answer

Attach an SCP to the root that explicitly denies cloudtrail:DeleteTrail and s3:PutBucketPolicy.. The correct strategy is to attach an SCP to the root that explicitly denies the `cloudtrail:DeleteTrail` and `s3:PutBucketPolicy` actions. SCPs act as a service control boundary that overrides any IAM-based permissions, and explicit deny statements in SCPs cannot be overridden by any account within the organization. Option D is incorrect because SCP order does not affect evaluation; all applicable SCPs are evaluated and any explicit deny takes precedence. Option E is invalid as SCPs cannot use 'deny all except' logic; they must explicitly allow or deny specific actions.

Answer

Use IAM policies with conditions to restrict deletion to certain IP addresses.

Answer

Attach an SCP to the root that allows all actions, and rely on IAM policies in each account.

Answer

Ensure that the SCPs are evaluated in the correct order, with deny statements taking precedence.

Answer

Attach an SCP that denies all actions except those necessary for CloudTrail and S3 operations.

Question 9

A company has an AWS Organization with a management account and several member accounts. The management account hosts a central S3 bucket that stores CloudTrail logs from all accounts. The company wants to ensure that only the management account can delete objects from this bucket. Which policy should be applied to the bucket?

Accepted Answer

A bucket policy that denies s3:DeleteObject unless the request is from the management account's root user.. A bucket policy with a Deny effect for s3:DeleteObject that includes a condition key (such as aws:PrincipalArn or aws:username) to allow the action only when the request originates from the management account's root user ensures that only the root user, not any IAM user or role in the management account, can delete objects. This directly enforces the requirement that only the management account's root user can delete objects, as the bucket policy is evaluated for every request to the bucket.

Answer

An SCP that denies s3:DeleteObject for all member accounts.

Answer

An SCP that denies s3:DeleteObject for all accounts except the management account.

Answer

A bucket policy that allows s3:DeleteObject only for the organizational unit containing the management account.

Question 10

A security engineer attaches this SCP to the root organizational unit. What is the result?

Accepted Answer

All IAM users and roles must use MFA for any AWS API call.. Based on the answer choices, the SCP attached to the root OU must be one that denies any AWS API call unless MFA is present. When such an SCP is applied at the root organizational unit, it affects all IAM users and roles across all accounts in the organization, requiring MFA for every API call. Therefore, option C is correct.

Answer

All actions are allowed only if MFA is not used.

Answer

Only the root user is required to use MFA.

Answer

All IAM users must use MFA to access the console, but API calls are not affected.

Question 11

A solutions architect sees this output from the AWS CLI. The management account (111111111111) has a service control policy (SCP) attached that denies all actions unless the request originates from a specific IP range. Which account(s) are affected by this SCP?

Accepted Answer

Only the ProductionAccount (222222222222).. SCPs attached to the management account do not affect the management account itself; they only apply to member accounts. Therefore, the ProductionAccount (222222222222) is the only account affected by this SCP because it is a member account, while the ManagementAccount (111111111111) is exempt from its restrictions.

Answer

Neither account.

Answer

Both accounts.

Answer

The ManagementAccount (111111111111) only.

Question 12

A multinational company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled. The company wants to enforce this policy centrally without modifying each bucket individually. Which solution is MOST effective?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless encryption is set.. AWS Organizations Service Control Policies (SCPs) can centrally restrict permissions across all member accounts. By applying an SCP to the root organizational unit that denies the s3:PutBucketEncryption action unless the request includes encryption configuration (e.g., by checking for the presence of a server-side encryption algorithm condition), the security team enforces that any new bucket encryption settings must enable server-side encryption. This approach requires no per-bucket or per-account configuration and works even against administrators in member accounts.

Answer

Create an IAM role that all users must assume to create buckets, and attach a policy requiring encryption.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to enable encryption.

Answer

Enable default encryption on each S3 bucket using a custom AWS Config rule.

Question 13

A company has a central IT team that manages multiple AWS accounts. The team wants to allow developers to create resources in their own accounts but wants to restrict the use of certain expensive services like Amazon Redshift. The developers should not be able to launch Redshift clusters in any account. What is the MOST efficient way to achieve this?

Accepted Answer

Apply an SCP that denies redshift:CreateCluster to the organizational unit containing the developer accounts.. SCPs can deny the redshift:CreateCluster action across all accounts in the organization, preventing developers from launching Redshift clusters regardless of their IAM permissions. Option B is wrong because AWS CloudTrail only logs API calls for auditing and does not prevent actions. Option C is wrong because IAM policies attached to groups in each account require manual setup per account and can be overridden if developers have permissions to modify IAM. Option D is wrong because AWS Config rules can detect noncompliant resources but cannot deny creation or automatically delete resources; they can only trigger remediation via other services.

Answer

Use AWS CloudTrail to monitor cluster creation and alert the security team.

Answer

Create an IAM policy that denies redshift:CreateCluster and attach it to the developers' IAM groups in each account.

Answer

Use AWS Config rules to detect Redshift cluster creation and automatically delete them.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally manage CloudWatch Logs from all accounts. The logs should be sent to a central S3 bucket in the management account. Which two actions should the team take? (Choose two.)

Accepted Answer

Configure the S3 bucket policy to allow the member accounts to write objects.. To centrally manage CloudWatch Logs from multiple accounts and send them to a central S3 bucket in the management account, the team must configure the S3 bucket policy to allow member accounts to write objects (option B). Additionally, they need to create an IAM role in the management account with permissions to read logs from member accounts (option C). This role can be used to assume a cross-account role and copy log data to the central S3 bucket. Option A is incorrect because CloudWatch Logs subscription filters cannot deliver logs directly to an S3 bucket; they require an intermediary such as Kinesis Data Firehose or Lambda. Option D is incorrect because SCPs cannot force export of logs; they can only deny actions. Option E is incorrect because CloudTrail only delivers its own trail logs, not CloudWatch Logs from all log groups.

Answer

Create a subscription filter in each member account's log groups that sends logs to the central S3 bucket.

Answer

Apply an SCP that requires all log groups to export logs to the central bucket.

Answer

Use AWS CloudTrail to deliver logs to the central bucket.

Question 15

A company uses AWS Organizations with multiple OUs. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID from a central list. The list changes frequently. What is the MOST scalable way to enforce this?

Accepted Answer

Use an SCP that denies ec2:RunInstances unless the AMI has a specific tag (e.g., "Approved":"true"). Central team tags approved AMIs.. Using a Service Control Policy (SCP) with a condition that denies ec2:RunInstances unless the AMI has a specific tag (e.g., 'Approved':'true') is scalable and centralized. The security team can simply tag approved AMIs, and the SCP automatically enforces the policy across all accounts in the organization without needing to update IAM policies or deploy infrastructure. This approach scales with frequent changes to the AMI list because only the tag needs to be applied or removed, not the policy itself.

Answer

Use AWS CloudFormation StackSets to deploy AMI approval rules via EC2 launch templates.

Answer

Use AWS Config with a custom rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Create an IAM policy condition that only allows ec2:RunInstances if the AMI ID matches a list in the condition.

Question 16

A company is implementing a new multi-account strategy using AWS Organizations. The central IT team wants to delegate management of certain AWS services to individual account administrators while maintaining centralized governance. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create SCPs that allow all actions except those managed centrally.. SCPs can be used to allow all actions except those managed centrally, effectively delegating management of non-centrally-managed services to individual account administrators while central IT retains control over specified services. Option C is correct because CloudFormation StackSets enable the central IT team to deploy baseline resources (e.g., IAM roles, security groups) consistently across all accounts, ensuring centralized governance while allowing local administrators to manage other aspects. Option A is incorrect because creating IAM roles assumable from the central account centralizes management, not delegates it to local administrators. Options D and E are incorrect due to security and governance risks.

Answer

Create IAM roles in each account that can be assumed from the central account with limited permissions.

Answer

Share the root user credentials of each account with the respective administrator.

Answer

Grant each account administrator full access to the management account.

Question 17

A company has a multi-account AWS environment with 50 accounts. They need to implement a centralized logging solution for VPC Flow Logs, CloudTrail, and AWS Config logs. The logs must be stored in a central S3 bucket and encrypted with a customer-managed KMS key. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create an S3 bucket policy that grants permissions to the CloudTrail and AWS Config service principals from all accounts to write logs.. To meet the requirements, three steps are necessary. First, option A: an S3 bucket policy must be created in the central account to grant the CloudTrail and AWS Config service principals from all 50 accounts the necessary permissions (e.g., s3:PutObject) to write logs into the central S3 bucket. Without this policy, cross-account log delivery would fail. Second, option C: CloudTrail must be configured in each account to deliver logs to the central S3 bucket. Each account's CloudTrail trail should specify the central S3 bucket as the destination. Third, option D: a customer-managed KMS key must be created with a key policy that allows the CloudTrail and AWS Config service principals to use the key for encryption. This ensures logs are encrypted at rest using the customer-managed key. Option B (AWS Config aggregator) is not required for S3 storage; it aggregates configuration data but does not store logs in S3. Option E (VPC Flow Logs to CloudWatch Logs) does not meet the requirement of storing logs in a central S3 bucket; VPC Flow Logs can be delivered directly to S3, but the question asks for three steps, and the correct ones are A, C, and D.

Answer

Use AWS Config aggregator to collect configuration data from all accounts into a central account.

Answer

Enable VPC Flow Logs in each account and deliver them to a central CloudWatch Logs group.

Question 18

An organization uses AWS Organizations with a multi-account strategy. The security team needs to ensure that all accounts must use AWS CloudTrail with logs delivered to a centralized S3 bucket. They also want to receive notifications if any account disables CloudTrail. What is the MOST efficient solution?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Use an S3 event notification on the centralized bucket to trigger a Lambda function that sends an SNS alert if logs stop arriving.. The SCP blocks disabling actions. To detect if logs stop arriving, a scheduled CloudWatch Events rule invokes a Lambda function that calls the DescribeTrails API and checks the last log delivery time. If logs have not been delivered recently, an SNS alert is sent. This combined approach provides both prevention and detection.

Answer

Use AWS CloudTrail to log management events and set up a CloudWatch Events rule that triggers on StopLogging API calls.

Answer

Use an SCP that requires all accounts to have a specific trust policy for CloudTrail. Use CloudTrail Insights to detect anomalous activity.

Answer

Deploy a Lambda function in each account that periodically checks CloudTrail status and sends an SNS message if disabled.

Question 19

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with a specific KMS key. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the specified KMS key is used.. Using an SCP at the root OU prevents any account from creating unencrypted buckets or using a different KMS key because SCPs affect all principals in the account. Option A is wrong because AWS Config rules only detect non-compliance and require a separate remediation action; they do not prevent the action. Option C is wrong because a bucket policy can enforce encryption on objects but not on the bucket encryption settings themselves, and managing StackSets across accounts is less efficient than a single SCP. Option D is wrong because managing IAM policies per account at scale is cumbersome and does not prevent root users.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them retroactively.

Answer

Deploy a CloudFormation StackSet that creates a bucket policy in each account requiring encryption.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless the specified KMS key is used.

Question 20

A company uses AWS Organizations with hundreds of accounts. They want to centrally manage VPC security group rules to ensure that only approved CIDR ranges are allowed for SSH access. Which solution is MOST scalable and auditable?

Accepted Answer

Use AWS CloudFormation StackSets to deploy security groups with approved rules, and use an SCP to deny creation or modification of security groups outside of CloudFormation.. It combines CloudFormation StackSets for deploying approved security groups across hundreds of accounts with an SCP that denies ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress actions unless they originate from CloudFormation (using the aws:ViaAWSService condition key). This ensures that only centrally managed, auditable deployments can create or modify security groups, providing both scalability and a clear audit trail via CloudFormation change sets and StackSet operations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remove the offending rules.

Answer

Create an SCP that denies ec2:AuthorizeSecurityGroupIngress for SSH ports unless the CIDR is in an approved list.

Answer

Use AWS Firewall Manager to centrally manage security group rules across accounts.