SAP-C02 Design Solutions for Organizational Complexity Practice Test 11 — 15 Questions

Question 1

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a cross-region read replica in the central account and grant access to other accounts.. Creating a cross-region read replica in the central account and granting access to other accounts allows each account to have a local read replica that stays in sync with the source, providing high availability and disaster recovery while minimizing cross-region data transfer costs (since replicas are in the same region as the source? Actually, the replica is cross-region, so costs are incurred, but among the given options, this is the only one that uses actual read replicas for continuous replication. Option C is wrong because restoring a snapshot creates an independent instance that does not automatically sync with the source, so it does not meet the requirement for continuous replication and disaster recovery.

Answer

Use a VPC endpoint to share the database across accounts without data transfer costs.

Answer

Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.

Answer

Create an IAM role in each account to access the central RDS instance directly.

Question 2

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

Accepted Answer

Nothing, shared subnets are automatically available to all accounts in the organization.. When AWS Organizations is configured with all features enabled and sharing is enabled within the organization, Resource Access Manager (RAM) automatically shares resources with all accounts in the organization without requiring individual acceptance. Therefore, shared subnets are immediately available to member accounts for launching resources, and no additional action is needed in the member accounts.

Answer

The member account must create an IAM role to assume for launching resources in the shared subnet.

Answer

The member account must create a VPC and then associate the shared subnet.

Answer

The member account must accept the resource share invitation.

Question 3

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

Accepted Answer

Use AWS Systems Manager Quick Setup to configure patching across accounts.. AWS Systems Manager Quick Setup is the most efficient way to centrally configure patching across multiple AWS accounts because it automates the deployment of SSM Patch Manager resources, including patch baselines, maintenance windows, and IAM roles, across accounts in an AWS Organization. It eliminates the need to manually set up patching in each account, providing a single-pane-of-glass management experience from the management account.

Answer

Use AWS Systems Manager Patch Manager in the management account.

Answer

Use AWS Systems Manager Automation documents in each account.

Answer

Use AWS Config rules to trigger patching in each account.

Question 4

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

Accepted Answer

Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.. An SCP (Service Control Policy) that denies `iam:CreateRole` unless the role has the required trust policy is the most scalable enforcement mechanism. SCPs are applied at the organizational unit (OU) or account level in AWS Organizations, allowing the central security team to centrally prevent the creation of non-compliant IAM roles across all business unit accounts without requiring per-account configuration or manual intervention. This approach enforces compliance proactively (preventive control) rather than reactively (detective control), and it scales automatically as new accounts are added to the organization.

Answer

Use AWS Config rules to detect non-compliant roles and send alerts.

Answer

Deploy the IAM roles using AWS CloudFormation StackSets.

Answer

Request each business unit to create the required IAM roles manually.

Question 5

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

Accepted Answer

Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.. AWS Organizations tag policies allow you to define rules for tagging resources across all accounts in the organization, including enforcement of required tags like 'CostCenter'. Tag policies are evaluated at resource creation and can prevent non-compliant resources from being created, ensuring consistent cost allocation tagging without requiring individual account-level IAM changes.

Answer

Create an IAM policy in each account that requires the CostCenter tag.

Answer

Use AWS Config rules to identify untagged resources and automatically tag them.

Answer

Use an SCP to deny resource creation if the CostCenter tag is missing.

Question 6

A company is designing a multi-account AWS environment with a centralized logging account. Which TWO services should be used to aggregate logs from all accounts?

Accepted Answer

AWS CloudTrail with cross-account S3 bucket. AWS CloudTrail can be configured to deliver log files to an S3 bucket in a centralized logging account by using cross-account S3 bucket policies. This allows all accounts in the organization to send their CloudTrail logs to a single destination, enabling centralized auditing and analysis.

Answer

Amazon S3 cross-region replication

Answer

Amazon VPC Flow Logs

Answer

Amazon Kinesis Data Firehose

Question 7

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

Accepted Answer

Configure S3 buckets in each account to use the shared KMS key for server-side encryption.. Configuring S3 buckets to use the shared KMS key for server-side encryption (SSE-KMS) ensures that all objects written to the bucket are encrypted at rest with the centralized key. Option C is correct because the KMS key must be created in the security account and shared via AWS RAM to allow other accounts to use it for encryption. Option E is correct because a service control policy (SCP) can be applied to deny s3:PutObject unless the request includes the required KMS key, providing an additional enforcement layer. Together, these steps enforce centralized encryption across accounts.

Answer

Configure S3 bucket policies in each account to enforce encryption using the KMS key.

Answer

Create IAM users in the security account and grant them access to the KMS key.

Question 8

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Accepted Answer

Create a centralized S3 bucket in the logging account.. Centralizing VPC flow logs requires a single S3 bucket in a dedicated logging account to aggregate logs from all accounts. This bucket must have a bucket policy that grants the necessary permissions for the flow log service to write logs from member accounts, enabling centralized storage and management.

Answer

Configure cross-account CloudWatch Logs subscription.

Answer

Use VPC Flow Logs with Amazon Kinesis Data Firehose.

Answer

Use AWS Config rules to enable flow logs automatically.

Question 9

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.. Applying an SCP at the OU level that denies S3 bucket creation/updates without KMS encryption and HTTPS enforcement provides centralized enforcement across all accounts in the OU. This is the most efficient method as it prevents non-compliant actions at the API level. Option A is incorrect because SCPs applied to the management account do not affect member accounts and the management account itself is not restricted by SCPs. Option B is incorrect because while Lambda functions could remediate, they are reactive and require per-account deployment, making them less efficient than proactive SCP enforcement. Option D is incorrect because AWS Config rules can detect non-compliance but do not automatically enforce; automatic remediation may require additional setup and is also reactive.

Answer

Apply a service control policy (SCP) to the management account.

Answer

Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

Answer

Use AWS Config rules with automatic remediation in each account.

Question 10

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

Accepted Answer

Use Amazon ECS with Fargate launch type, defining services across multiple AZs.. Amazon ECS with Fargate is the best choice because it provides serverless container orchestration, automatically managing infrastructure and scaling. By deploying services across multiple Availability Zones, it ensures high availability and low-latency communication without the operational overhead of managing EC2 instances or Kubernetes control planes. AWS Lambda introduces cold start latency and a 15-minute execution limit, making it unsuitable for strict latency requirements and long-running microservices. EC2 instances and EKS require more operational overhead for patching and scaling. Fargate minimizes that overhead while meeting latency and multi-AZ requirements.

Answer

Use AWS Lambda functions for each microservice, triggered by API Gateway.

Answer

Deploy each microservice on Amazon EC2 instances in an Auto Scaling group across AZs.

Answer

Use Amazon EKS with worker nodes on EC2, and deploy microservices as Kubernetes pods.

Question 11

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.. AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs attach to a central Transit Gateway, and a dedicated inspection VPC (with the security appliance) acts as the central inspection point. By configuring route tables in the Transit Gateway to route all inter-VPC traffic through the inspection VPC, you achieve mandatory traffic inspection without complex peering or performance bottlenecks.

Answer

Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.

Answer

Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC.

Question 12

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

Accepted Answer

An SCP that denies ec2:RunInstances when the instance type is not t2.micro.. An SCP that denies ec2:RunInstances when the instance type is not t2.micro will prevent launching any instance type other than t2.micro. SCPs are centralized and can be applied to OUs. Option A is incorrect because IAM policies are per-account and not centralized. Option B is incorrect because an allow SCP by itself would only allow t2.micro but would not prevent other instance types unless the default is to deny all, which is not the case. Option D is incorrect because AWS Config rules are reactive and do not prevent actions; they only detect and can remediate after the fact.

Answer

An IAM policy applied to each account's admin role to restrict instance types.

Answer

An SCP that allows ec2:RunInstances only for t2.micro.

Answer

An AWS Config rule to terminate non-compliant instances.

Question 13

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with MySQL compatibility.. Amazon Aurora Global Database with MySQL compatibility is designed for cross-Region disaster recovery with a Recovery Time Objective (RTO) of less than 1 minute and minimal data loss (typically sub-second). It uses storage-based replication that is asynchronous but with very low latency, and it supports a managed failover process that promotes a secondary Region to primary in under a minute, meeting the strict RTO requirement.

Answer

Use cross-Region Read Replicas with automatic failover.

Answer

Use a Multi-AZ RDS instance with a standby in another Region.

Answer

Use AWS Database Migration Service for continuous replication.

Question 14

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 15

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

Accepted Answer

Define cost allocation tags for each department and enable them in the Billing and Cost Management console.. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Finance') and then activate those tags in the Billing and Cost Management console. Once enabled, AWS Cost Explorer and cost reports can filter and group costs by these tags, providing accurate per-department cost tracking across multiple accounts in AWS Organizations. This is the most precise method because it directly associates resource usage with the department responsible, regardless of which account hosts the resource.

Answer

Use AWS Cost Explorer to view costs by linked account.

Answer

Set up AWS Budgets for each department with alerts.

Answer

Create AWS Resource Groups for each department and use AWS Config to track costs.