SAP-C02 Design Solutions for Organizational Complexity Practice Test 11 — 15 Questions

Question 1

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with MySQL compatibility.. Option D is correct because Amazon RDS for MySQL does not support cross-Region synchronous replication; the best option is to use Amazon Aurora Global Database with MySQL compatibility, which provides fast replication and failover. Option A is wrong because cross-Region Read Replicas are asynchronous and may have data loss. Option B is wrong because Multi-AZ is single-Region. Option C is wrong because Database Migration Service is for migration, not continuous replication with low RTO.

Answer

Use cross-Region Read Replicas with automatic failover.

Answer

Use a Multi-AZ RDS instance with a standby in another Region.

Answer

Use AWS Database Migration Service for continuous replication.

Question 2

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. Option A is correct because S3 Object Lock in compliance mode prevents any user from overwriting or deleting objects for the specified retention period. Option B is wrong because MFA Delete does not prevent root user deletion. Option C is wrong because bucket policies can be changed. Option D is wrong because versioning alone does not prevent deletion.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 3

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

Accepted Answer

Define cost allocation tags for each department and enable them in the Billing and Cost Management console.. Option B is correct because using cost allocation tags that propagate to all accounts and organizing resources by department allows accurate cost tracking in AWS Cost Explorer. Option A is wrong because linked account aggregation does not break down by department. Option C is wrong because resource groups are not for cost allocation. Option D is wrong because budgeting does not allocate costs.

Answer

Use AWS Cost Explorer to view costs by linked account.

Answer

Set up AWS Budgets for each department with alerts.

Answer

Create AWS Resource Groups for each department and use AWS Config to track costs.

Question 4

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

Accepted Answer

Configure an SQS dead-letter queue for failed messages.. Option D is correct because enabling a dead-letter queue (DLQ) on SQS captures messages that fail processing, preventing loss. Option A is wrong because reserved concurrency limits throughput. Option B is wrong because maxBatchingWindow increases latency. Option C is wrong because provisioned capacity may not handle spikes efficiently.

Answer

Increase the SQS visibility timeout to 30 minutes.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Set Lambda reserved concurrency to a low value to control costs.

Question 5

A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?

Accepted Answer

A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.. Option C is correct because cross-account access requires both a trust policy in the production account allowing the dev account to assume the role, and an IAM policy in the dev account granting sts:AssumeRole. Option A is wrong because SCPs are not used for cross-account role assumption. Option B is wrong because roles are assumed, not users. Option D is wrong because a role must exist in the target account.

Answer

A role in the dev account with permissions to access production resources.

Answer

An IAM user in the production account with permissions to switch roles.

Answer

An SCP that allows sts:AssumeRole from the dev account.

Question 6

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

Accepted Answer

Enable default encryption with SSE-S3 or SSE-KMS.. Options A and D are correct. Option A: Blocking public access prevents unintended exposure. Option D: Enabling server-side encryption protects data at rest. Option B is wrong because S3 Transfer Acceleration does not provide security. Option C is wrong because lifecycle policies manage storage, not security. Option E is wrong because S3 Select is for querying, not security.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Answer

Enable S3 Select to filter data.

Question 7

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

Accepted Answer

Use Amazon EventBridge for event-driven integration.. Options A, C, and D are correct. Option A: SQS decouples services via message queues. Option C: SNS enables fan-out to multiple subscribers. Option D: EventBridge supports event-driven communication. Option B is wrong because ELB is for load balancing, not decoupling. Option E is wrong because Direct Connect is for hybrid connectivity.

Answer

Use AWS Direct Connect for private connectivity.

Answer

Use Elastic Load Balancing to distribute traffic.

Question 8

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account log groups.. Options A and D are correct. Option A: CloudWatch Logs can aggregate logs from multiple accounts using cross-account subscriptions. Option D: Amazon S3 can serve as a central log destination for CloudTrail and other logs. Option B is wrong because Kinesis is for streaming, not central log storage. Option C is wrong because CloudFormation is for infrastructure as code. Option E is wrong because SQS is for messaging.

Answer

Amazon SQS.

Answer

AWS CloudFormation.

Answer

Amazon Kinesis Data Firehose.

Question 9

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.. Using an SCP at the root OU is the most efficient way to enforce the policy across all accounts, as it applies to all member accounts and cannot be overridden by account administrators. Option A is wrong because SCPs can enforce restrictions. Option B is wrong because it would require per-account changes. Option D is wrong because bucket policies are account-specific and do not enforce across accounts.

Answer

Use AWS Config rules to detect and remediate public buckets in each account.

Answer

Create a CloudFormation StackSet to deploy bucket policies in every account.

Answer

Use IAM roles to restrict users from modifying bucket public access settings.

Question 10

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

Accepted Answer

Apply an SCP that allows EC2 actions only in the allowed Regions.. Using an SCP with a Deny effect for EC2 actions outside allowed Regions is the best approach because it prevents the action across all accounts. Option A is wrong because IAM permissions boundaries are per-role. Option B is wrong because it allows EC2 in all Regions. Option D is wrong because it allows launching in all Regions.

Answer

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Answer

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Answer

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Question 11

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

Accepted Answer

Apply an SCP that denies the organizations:LeaveOrganization action.. An SCP with a Deny effect on organizations:LeaveOrganization prevents any account from leaving. Option B is wrong because IAM is account-specific. Option C is wrong because CloudTrail only logs. Option D is wrong because it doesn't prevent.

Answer

Configure IAM policies on the root user of each account to deny leave actions.

Answer

Create an AWS Config rule to detect leave attempts.

Answer

Enable AWS CloudTrail to monitor leave events and send alerts.

Question 12

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

Accepted Answer

Use a CloudFormation StackSet to deploy VPC Flow Logs to an S3 bucket in the central account using bucket policies.. Using VPC Flow Logs with a delivery to a central S3 bucket via cross-account permissions is scalable. Option A is wrong because it requires per-VPC setup. Option C is wrong because it adds cost and complexity. Option D is wrong because it doesn't centralize.

Answer

Deploy a third-party log collector agent on each EC2 instance.

Answer

Configure AWS Transit Gateway to aggregate flow logs.

Answer

Enable VPC Flow Logs in each account and publish to a CloudWatch Logs group in the central account.

Question 13

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

Accepted Answer

Apply an SCP that denies ec2:RunInstances unless the request includes the CostCenter tag.. Using an SCP to deny creation of untagged resources is effective. Option A is wrong because AWS Config can detect but not enforce. Option C is wrong because it doesn't prevent creation. Option D is wrong because it's after the fact.

Answer

Use AWS Service Catalog to enforce tagging on provisioned products.

Answer

Run a Lambda function that tags resources after creation based on the creator's cost center.

Answer

Use AWS Config rules to mark non-compliant resources and auto-remediate.

Question 14

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

Accepted Answer

Create an IAM policy that denies EC2 actions unless the region is us-east-1.. An IAM policy with a condition on ec2:Region is the simplest. Option B is wrong because SCPs are for Organizations. Option C is wrong because it's per-VPC. Option D is wrong because it's reactive.

Answer

Use AWS Config to terminate instances in other Regions.

Answer

Apply an SCP to the account.

Answer

Configure the default VPC in us-east-1 only.

Question 15

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

Accepted Answer

Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.. An SCP that denies RunInstances unless the AMI ID is in the allowed list is scalable. Option A is wrong because it's per-account. Option C is wrong because it doesn't prevent. Option D is wrong because it's after creation.

Answer

Use AWS Config to detect non-compliant AMIs and stop the instances.

Answer

Create a service catalog product for EC2 with allowed AMIs.

Answer

Use AWS Systems Manager to enforce AMI compliance.