SAP-C02 Design Solutions for Organizational Complexity Practice Test 10 — 15 Questions

Question 1

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

Accepted Answer

Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.. Option D is correct because SCPs can deny the creation of S3 buckets without encryption or with the wrong KMS key, and AWS Config rules can detect non-compliant existing buckets for remediation. Option A is wrong because IAM policies alone cannot enforce encryption at the organizational level across multiple accounts. Option B is wrong because AWS CloudTrail only logs, not enforces. Option C is wrong because AWS Service Catalog is not designed for this purpose.

Answer

Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.

Answer

Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.

Question 2

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

AWS CloudFormation Change Sets. Option A is correct because Change Sets allow you to preview changes before applying them. Option B is wrong because StackSets are for managing stacks across multiple accounts. Option C is wrong because Drift Detection identifies differences, not review changes. Option D is wrong because Nested Stacks are for reusing templates, not for review.

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Nested Stacks

Question 3

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.. Option C is correct because an SCP can deny access if MFA is not present, and it applies to all accounts in the organization. Option A is wrong because an IAM policy in each account requires manual effort and is not centralized. Option B is wrong because AWS Config can detect but not enforce. Option D is wrong because CloudTrail logs but does not enforce.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.

Answer

Create an IAM policy in each account that denies access without MFA.

Question 4

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

Accepted Answer

Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.. Option D is correct because sharing the RDS snapshot with each account and restoring as a read replica in the same region avoids data transfer costs. Option A is wrong because a single cross-region replica incurs data transfer costs. Option B is wrong because direct cross-account access is not supported for read replicas. Option C is wrong because a VPC endpoint does not eliminate data transfer costs for RDS replication.

Answer

Use a VPC endpoint to share the database across accounts without data transfer costs.

Answer

Create a cross-region read replica in the central account and grant access to other accounts.

Answer

Create an IAM role in each account to access the central RDS instance directly.

Question 5

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

Accepted Answer

Nothing, shared subnets are automatically available to all accounts in the organization.. Option A is correct because shared subnets automatically appear in the member account's VPC console, and they can launch resources without additional configuration. Option B is wrong because no resource share acceptance is needed if sharing within the same organization. Option C is wrong because shared subnets are already in the member account's VPC. Option D is wrong because no IAM role is needed for subnet sharing.

Answer

The member account must create an IAM role to assume for launching resources in the shared subnet.

Answer

The member account must create a VPC and then associate the shared subnet.

Answer

The member account must accept the resource share invitation.

Question 6

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

Accepted Answer

Use AWS Systems Manager Quick Setup to configure patching across accounts.. Option B is correct because Systems Manager Quick Setup can configure automation across accounts from a central management account. Option A is wrong because Systems Manager Automation alone does not handle multi-account. Option C is wrong because Systems Manager Patch Manager is a component, not a multi-account solution. Option D is wrong because AWS Config is for compliance, not patching.

Answer

Use AWS Systems Manager Patch Manager in the management account.

Answer

Use AWS Systems Manager Automation documents in each account.

Answer

Use AWS Config rules to trigger patching in each account.

Question 7

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

Accepted Answer

Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.. Option C is correct because SCPs can deny the creation of IAM roles that do not match the required trust policy, enforcing the use of specific roles. Option A is wrong because IAM roles in each account require manual setup. Option B is wrong because AWS CloudFormation StackSets can deploy the roles but cannot prevent creation of non-compliant roles. Option D is wrong because AWS Config can detect but not prevent.

Answer

Use AWS Config rules to detect non-compliant roles and send alerts.

Answer

Deploy the IAM roles using AWS CloudFormation StackSets.

Answer

Request each business unit to create the required IAM roles manually.

Question 8

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

Accepted Answer

Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.. Option D is correct because AWS Organizations has a tag policy feature that can enforce tags on resources during creation. Option A is wrong because SCPs can deny creation without tags, but tag policies are more specific. Option B is wrong because AWS Config can detect but not enforce. Option C is wrong because IAM policies can enforce but require per-account configuration.

Answer

Create an IAM policy in each account that requires the CostCenter tag.

Answer

Use AWS Config rules to identify untagged resources and automatically tag them.

Answer

Use an SCP to deny resource creation if the CostCenter tag is missing.

Question 9

A company is designing a multi-account AWS environment with a centralized logging account. Which TWO services should be used to aggregate logs from all accounts?

Accepted Answer

AWS CloudTrail with cross-account S3 bucket. Options A and D are correct. CloudTrail logs can be delivered to a centralized S3 bucket in the logging account using cross-account delivery. CloudWatch Logs can be aggregated using cross-account subscription filters to a central account. Option B is wrong because Kinesis Data Firehose can be used but is not the primary aggregator for logs. Option C is wrong because S3 is a storage destination, not an aggregation service. Option E is wrong because VPC Flow Logs are sent to S3 or CloudWatch Logs, not directly to a central account.

Answer

Amazon S3 cross-region replication

Answer

Amazon VPC Flow Logs

Answer

Amazon Kinesis Data Firehose

Question 10

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

Accepted Answer

Configure S3 buckets in each account to use the shared KMS key for server-side encryption.. Options A, C, and D are correct. Create a KMS key in the security account and share it via RAM. In each account, use the shared KMS key when creating S3 buckets. Apply an SCP to enforce the use of the shared KMS key. Option B is wrong because S3 bucket policies are account-specific and cannot enforce across accounts. Option E is wrong because IAM users are not the best mechanism for cross-account access; RAM is simpler.

Answer

Configure S3 bucket policies in each account to enforce encryption using the KMS key.

Answer

Create IAM users in the security account and grant them access to the KMS key.

Question 11

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Accepted Answer

Create a centralized S3 bucket in the logging account.. Options A and D are correct. First, create a centralized S3 bucket to store flow logs. Then, use an SCP to enforce enabling flow logs on all VPCs. Option B is wrong because AWS Config can detect but not enforce. Option C is wrong because CloudWatch Logs cross-account subscription is not necessary if using S3. Option E is wrong because VPC Flow Logs can be delivered to S3 directly.

Answer

Configure cross-account CloudWatch Logs subscription.

Answer

Use VPC Flow Logs with Amazon Kinesis Data Firehose.

Answer

Use AWS Config rules to enable flow logs automatically.

Question 12

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.. Option B is correct because SCPs can be applied at the OU level to deny non-compliant actions across all accounts, providing centralized enforcement. Option A is wrong because service control policies are not applied to the management account. Option C is wrong because AWS Config rules detect non-compliance but do not enforce. Option D is wrong because custom Lambda functions would require per-account deployment and are less efficient.

Answer

Apply a service control policy (SCP) to the management account.

Answer

Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

Answer

Use AWS Config rules with automatic remediation in each account.

Question 13

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

Accepted Answer

Use Amazon ECS with Fargate launch type, defining services across multiple AZs.. Option D is correct because Amazon ECS with Fargate provides serverless container orchestration, reducing operational overhead, and can be deployed across AZs for high availability and low latency. Option A is wrong because AWS Lambda has execution time limits and may not suit long-running services. Option B is wrong because EC2 requires patching and capacity management. Option C is wrong because EKS adds Kubernetes complexity.

Answer

Use AWS Lambda functions for each microservice, triggered by API Gateway.

Answer

Deploy each microservice on Amazon EC2 instances in an Auto Scaling group across AZs.

Answer

Use Amazon EKS with worker nodes on EC2, and deploy microservices as Kubernetes pods.

Question 14

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.. Option C is correct because a Transit Gateway with a central inspection VPC (using a firewall appliance) allows routing all inter-VPC traffic through the inspection point. Option A is wrong because VPC peering does not provide a central inspection point. Option B is wrong because Direct Connect is for on-premises connectivity. Option D is wrong because Network Load Balancer does not perform traffic inspection.

Answer

Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.

Answer

Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC.

Question 15

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

Accepted Answer

An SCP that denies ec2:RunInstances when the instance type is not t2.micro.. Option B is correct because a deny SCP on the RunInstances action for non-allowed instance types will prevent launching those instances. Option A is wrong because allow SCPs require explicit allow, which is not the best approach here. Option C is wrong because IAM policies are per-account and not centralized. Option D is wrong because AWS Config does not prevent actions.

Answer

An IAM policy applied to each account's admin role to restrict instance types.

Answer

An SCP that allows ec2:RunInstances only for t2.micro.

Answer

An AWS Config rule to terminate non-compliant instances.