SAP-C02 Design Solutions for Organizational Complexity Practice Test 10 — 15 Questions

Question 1

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions. Service Control Policies (SCPs) can be applied at the organizational unit (OU) or account level to deny the creation of roles with trust policies that allow access from another AWS account unless the trust policy meets specific conditions (e.g., requiring approval or restricting to accounts within the organization). Option B is wrong because IAM policies are account-level and cannot prevent role creation across accounts; they can only control who within an account can create roles, not the content of the trust policy. Option C is wrong because AWS Lambda can automatically delete non-compliant roles after creation, but it cannot prevent the initial creation, which is the requirement. Option D is wrong because AWS Config rules can detect and alert on risky trust policies, but they cannot deny or prevent role creation; they are detective, not preventive.

Answer

Use IAM policies to restrict who can create roles

Answer

Use AWS Lambda to automatically delete non-compliant roles

Answer

Use AWS Config rules to detect and alert on risky trust policies

Question 2

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

Accepted Answer

Use Systems Manager Explorer with multi-account management. Systems Manager Explorer provides a built-in, multi-account view that aggregates operational data (e.g., patch compliance, inventory) from all member accounts in AWS Organizations without requiring custom scripts or manual setup. It leverages AWS Organizations to automatically discover and manage instances across accounts, making it the simplest centralized management solution.

Answer

Use AWS Config to aggregate configuration data

Answer

Use Systems Manager Automation runbooks in each account

Answer

Use CloudFormation StackSets to deploy Systems Manager agents

Question 3

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

Accepted Answer

Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM. Route 53 Resolver outbound endpoints in the central account can forward DNS queries to the central private hosted zones, and the associated Resolver rules can be shared with other accounts via AWS Resource Access Manager (RAM). This provides a centralized, scalable DNS resolution architecture without requiring VPC peering or duplicating hosted zones across accounts.

Answer

Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account

Answer

Create a VPC peering connection between each VPC and the central account's VPC

Answer

Use AWS PrivateLink to connect VPCs to a central DNS service

Question 4

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

Accepted Answer

Use a service control policy (SCP) that denies EC2 RunInstances unless the AMI ID matches the approved list. A service control policy (SCP) can centrally deny the EC2 RunInstances action across all accounts in an AWS Organization unless the request specifies an AMI ID from an approved list. SCPs act as a permission guardrail that cannot be overridden by account-level IAM policies, making them the only mechanism that enforces a mandatory AMI ID across 200 accounts without relying on post-launch detection or per-account configuration.

Answer

Use IAM policies in each account to restrict the AMI ID

Answer

Use AWS Config rules with auto-remediation to stop non-compliant instances

Answer

Use CloudFormation StackSets to enforce AMI IDs for all new instances

Question 5

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Accepted Answer

Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it. It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.

Answer

Use a service control policy to allow access from other accounts

Answer

Create IAM users in the development account for each developer

Answer

Share the access keys of an IAM user in the development account

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation. AWS Config rules can be used to continuously monitor CloudTrail configuration across accounts and automatically trigger remediation actions (e.g., via AWS Systems Manager Automation or Lambda) when non-compliance is detected. This ensures that any drift from the required CloudTrail setup is corrected without manual intervention, providing a detective and corrective control. Option E is correct because a service control policy (SCP) can deny the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions at the organizational level, preventing any account from disabling or modifying the central CloudTrail trail, thus enforcing the required configuration proactively.

Answer

Create an IAM role in each account that requires CloudTrail to be enabled

Answer

Use CloudFormation StackSets to deploy a CloudTrail trail in each account

Answer

Use AWS Lambda to automatically re-enable CloudTrail if it is disabled

Question 7

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations. AWS Organizations is correct because it provides a centralized governance framework for managing multiple AWS accounts, enabling the security team to apply service control policies (SCPs) that centrally restrict IAM permissions across all member accounts. This allows the security account to enforce permission boundaries and audit IAM actions at the organizational level.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Accepted Answer

Permission sets that define the level of access to each account. AWS Single Sign-On requires an identity source and permission sets. The identity source can be the built-in identity store or an external identity provider (IdP). Therefore, an external IdP is not strictly required. From the given options, only permission sets (E) are a required component.

Answer

AWS Cloud Directory

Answer

A service control policy (SCP) attached to the root

Answer

An IAM user in each account

Answer

An external identity provider (IdP) such as Azure AD or Okta

Question 9

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

Accepted Answer

The SCP is not attached to the correct OU or root. The most likely reason is that the SCP is not attached to the correct OU or root. SCPs must be explicitly attached to the target OU, account, or root to take effect. If the SCP is attached to a different OU or not attached at all, it will not restrict the accounts in the intended OU, allowing users to launch any instance type.

Answer

The SCP syntax is invalid because it uses StringNotEquals

Answer

The SCP must also allow the allowed instance types in a separate statement

Answer

The SCP does not include an Allow statement for the allowed instance types

Question 10

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

Accepted Answer

The trust policy only allows the root user, not individual users. The trust policy explicitly allows only the root user of account 111111111111 (arn:aws:iam::111111111111:root) to assume the role. Individual IAM users within that account are not granted permission unless the trust policy includes the specific user ARN or a condition that allows federated access. Since the user is not the root user, the sts:AssumeRole call fails due to the principal restriction in the trust policy.

Answer

A service control policy in account 222222222222 is denying the sts:AssumeRole action

Answer

The role is not in the same region as the user

Answer

The trust policy is malformed

Question 11

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

Accepted Answer

The trail is not an organization trail. The exhibit shows that the CloudTrail trail 'my-trail' is not configured as an organization trail. In AWS Organizations, a trail must be explicitly created as an organization trail to automatically log management events from all member accounts. Without this setting, the trail only captures events from the management account, not the entire organization.

Answer

The trail is not a multi-region trail

Answer

The trail does not include global service events

Answer

The trail has log file validation enabled, which prevents cross-account delivery

Question 12

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

Accepted Answer

Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.. Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum permissions for all accounts in an organizational unit (OU). By attaching an SCP that denies EC2 actions in non-compliant regions, you enforce the restriction across multiple accounts without needing to manage individual IAM policies or roles, making it the most scalable solution.

Answer

Create an IAM role in each account with a policy to deny non-compliant regions.

Answer

Use AWS Config rules to detect and terminate instances in non-compliant regions.

Answer

Create an IAM policy in each account to deny non-compliant regions.

Question 13

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

Accepted Answer

Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.. SCPs can deny the creation of S3 buckets without encryption or with the wrong KMS key, and AWS Config rules can detect non-compliant existing buckets for remediation. Option A is wrong because AWS Service Catalog is not designed for this purpose. Option B is wrong because IAM policies alone cannot enforce encryption at the organizational level across multiple accounts. Option C is wrong because AWS CloudTrail only logs, not enforces.

Answer

Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.

Answer

Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.

Question 14

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

AWS CloudFormation Change Sets. AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the DevOps team to review and approve stack updates by generating a summary of the changes (additions, modifications, deletions) without executing them immediately, meeting the requirement for a review-and-approval workflow.

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Nested Stacks

Question 15

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.. A Service Control Policy (SCP) applied at the root or organizational unit (OU) level in AWS Organizations can centrally deny all AWS API actions for any principal that does not have a multi-factor authentication (MFA) device associated with the session. This enforces MFA across all member accounts without requiring individual account-level IAM policy changes, making it the most efficient and scalable solution for the security team's requirement.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.

Answer

Create an IAM policy in each account that denies access without MFA.