SAP-C02 Design Solutions for Organizational Complexity Practice Test 11 — 15 Questions

Question 1

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Control Tower Account Factory Customization (AFC).. AWS Control Tower Account Factory Customization (AFC) is designed to automatically apply custom CloudFormation templates to new accounts provisioned through Account Factory within a specified OU. It uses lifecycle events to trigger the deployment, ensuring that every new account in the OU receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog portfolio to share templates.

Answer

Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

Answer

Use AWS CloudFormation StackSets and manually trigger them for new accounts.

Question 2

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

Accepted Answer

Enable AWS Config aggregator and use advanced queries to search for trust policies.. AWS Config aggregator with advanced queries allows you to query the resource configuration of IAM roles across all accounts in AWS Organizations from a single management account. This approach is serverless, scalable, and provides a centralized view without needing to script cross-account access or manage multiple findings. The query can filter on the 'assumeRolePolicyDocument' field to detect trust policies that allow external principals (e.g., 'Effect: Allow' with 'AWS': '*' or a non-account ARN).

Answer

Use AWS Trusted Advisor to check for overly permissive roles.

Answer

Write a script using AWS SDK to list roles in each account and analyze trust policies.

Answer

Use IAM Access Analyzer to generate findings for each account.

Question 3

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

Accepted Answer

Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.. AWS Cost Categories allow finance teams to define rule-based groupings that map costs to departments, and critically, they support a 'default' or catch-all rule that captures untagged resources so no spend is left unallocated. Pairing this with AWS Budgets provides alerting when untagged or unallocated spend appears. This combination directly addresses the requirement to allocate costs even when tagging is incomplete, without blocking workloads.

Answer

Use AWS Trusted Advisor to check for untagged resources.

Answer

Use Service Control Policies to deny creation of untagged resources.

Answer

Use AWS Cost Explorer to filter by tags and manually identify untagged resources.

Question 4

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

Accepted Answer

Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.. AWS Backup requires cross-account IAM roles to delegate backup and restore permissions. The central backup account assumes an IAM role in each member account that has a trust policy allowing the backup account's IAM entity to perform backup and restore actions. This is the minimal set of permissions needed to manage backups across accounts without granting broader access.

Answer

Create a customer managed key in the backup account and share it with member accounts.

Answer

Grant the backup account full S3 access to member account buckets.

Answer

Enable AWS Config in member accounts to track backup compliance.

Question 5

A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?

Accepted Answer

Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that denies EC2:RunInstances in non-approved regions, you enforce a guardrail that applies to all IAM users and roles in the member accounts, regardless of their individual IAM policies. This is the most effective approach because SCPs are evaluated before IAM policies and cannot be overridden by account administrators.

Answer

Use AWS Config rules to detect EC2 instances in non-approved regions and trigger automatic termination.

Answer

Create IAM policies in each account that deny EC2 actions outside approved regions.

Answer

Use VPC endpoints to restrict API calls to approved regions.

Question 6

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records API activity across accounts, and with an organization trail it can deliver events from all member accounts to a central location. Amazon CloudWatch Logs (D) is correct because CloudTrail can be configured to send its event logs to a centralized CloudWatch Logs log group, enabling unified monitoring, metric filters, and alarms across accounts. Together, CloudTrail captures the API calls and CloudWatch Logs centralizes and analyzes them. VPC Flow Logs (A) only capture IP traffic metadata for network interfaces, not API calls. AWS Config (C) records resource configuration changes and compliance, not the full set of API calls. Amazon S3 (E) is a common CloudTrail delivery target, but by itself it does not provide the centralized logging and analysis service combination asked for here.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon S3

Question 7

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Accepted Answer

Enable AWS Systems Manager Inventory in each account.. Option C is correct because AWS Systems Manager Inventory is the service that actually collects and stores metadata about EC2 instances (applications, files, network config, Windows updates, etc.), and it must be enabled in each account where instances reside so their inventory data is gathered. Option E is correct because Systems Manager itself must be enabled/configured in each account (instances need the SSM agent and an instance profile with the AmazonSSMManagedInstanceCore policy) before Inventory can function; without Systems Manager enabled, Inventory cannot run. Option D is correct because to aggregate inventory across accounts, a central account needs permission to query member accounts, which is achieved by creating an IAM role in each member account that trusts the central (management) account, allowing cross-account access. Option A is incorrect because the CloudWatch agent sends metrics and logs, not Systems Manager inventory data. Option B is incorrect because AWS Config aggregators aggregate configuration and compliance data, not Systems Manager Inventory data, so they do not fulfill the EC2 instance inventory requirement.

Answer

Configure Amazon CloudWatch agent to send inventory data.

Answer

Set up an AWS Config aggregator in the management account.

Question 8

A financial services company uses AWS Organizations with a multi-account structure: a central security account, a shared services account, and multiple workload accounts. The security team needs to centrally manage and audit all changes to security groups across all accounts. They have implemented AWS Config with an aggregator in the security account. However, they notice that changes to security groups in workload accounts are not appearing in the aggregator. The workload accounts have AWS Config enabled and are recording security group changes. The security account has the necessary cross-account permissions. What is the most likely cause and solution?

Accepted Answer

The security account is not authorized in each workload account's Config settings. The security team must add the security account as an authorized aggregator in each workload account.. For an AWS Config aggregator in a central account to collect data from source accounts, each source account must explicitly authorize the aggregator account by adding it as an authorized aggregator. Without this authorization, the source account's Config data is not shared, even though Config is recording and cross-account IAM permissions exist.

Answer

AWS CloudTrail is not enabled in workload accounts. The security team must enable CloudTrail.

Answer

Service Control Policies are blocking cross-account access. The security team must modify SCPs to allow Config aggregation.

Answer

AWS Config in workload accounts is not recording security group changes. The security team must enable recording for security groups.

Question 9

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

Accepted Answer

Use IAM policies with conditions based on resource tags to restrict access within the single account.. It allows business units to have their own IAM users and permissions within the single account by using IAM policies with conditions based on resource tags, minimizing administrative overhead and avoiding additional costs associated with multiple accounts. Option A is incorrect because creating an OU within the existing account does not provide separate IAM user management; OUs are for grouping accounts in Organizations, not for user management. Option C is incorrect because while separate accounts with consolidated billing can provide separation, it increases administrative overhead and may lead to higher costs due to minimum usage per account. Option D is incorrect because SCPs are used to manage permissions at the account level, not for individual IAM users; they cannot provide the granular user-level control that the business units require.

Answer

Create an Organizational Unit for each business unit within the existing account.

Answer

Create a separate AWS account for each business unit and use consolidated billing to manage costs.

Answer

Use Service Control Policies to restrict each business unit's access to specific services.

Question 10

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

Accepted Answer

Create an SCP to deny PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that do not meet the requirements.. Option C is correct because Service Control Policies (SCPs) applied through AWS Organizations can centrally deny S3 API actions such as PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock when they would disable encryption or allow public access, providing preventive enforcement across all member accounts. Option E is correct because AWS Config rules can detect non-compliant S3 buckets (for example, using managed rules like s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited) and, with remediation actions, automatically re-enable encryption or block public access, providing detective and corrective enforcement. Option A is not appropriate because AWS Service Catalog governs provisioning of approved products and cannot enforce settings on existing or independently created S3 buckets. Option B is not appropriate because tag policies only standardize tag usage and cannot enforce encryption or public access configuration. Option D is not appropriate because IAM policies in the management account do not apply to IAM principals in member accounts and cannot centrally enforce bucket-level settings across the organization.

Answer

Use AWS Service Catalog to enforce S3 bucket encryption and public access settings.

Answer

Define a tag policy that requires encryption and public access tags on all S3 buckets.

Answer

Use IAM policies in the management account to restrict S3 permissions for all users.

Question 11

A company has a multi-account AWS environment with 50 accounts. They need to implement a centralized logging solution for VPC Flow Logs, CloudTrail, and AWS Config logs. The logs must be stored in a central S3 bucket and encrypted with a customer-managed KMS key. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create an S3 bucket policy that grants permissions to the CloudTrail and AWS Config service principals from all accounts to write logs.. Option A is correct because the central S3 bucket must have a bucket policy that explicitly grants the CloudTrail and AWS Config service principals from all 50 accounts s3:PutObject (and related) permissions, otherwise cross-account delivery of logs will be denied. Option C is correct because CloudTrail must be configured (typically as an organization trail or per-account trail) in each account to deliver its log files to the central S3 bucket, ensuring all accounts' API activity is captured centrally. Option D is correct because a customer-managed KMS key requires a key policy that allows the CloudTrail and AWS Config service principals to call kms:GenerateDataKey and kms:Decrypt, enabling SSE-KMS encryption of the delivered logs. Option B does not belong because an AWS Config aggregator only consolidates configuration and compliance data for querying; it does not store or encrypt raw logs in the central S3 bucket. Option E does not belong because the requirement is to store VPC Flow Logs in the central S3 bucket, not in a CloudWatch Logs group, so delivering them to CloudWatch Logs would not meet the centralized S3 storage requirement.

Answer

Use AWS Config aggregator to collect configuration data from all accounts into a central account.

Answer

Enable VPC Flow Logs in each account and deliver them to a central CloudWatch Logs group.

Question 12

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Accepted Answer

Create an SCP that denies all actions in non-approved regions.. Option A is correct because an AWS Organizations service control policy (SCP) attached at the root or OU level can use a Deny statement with a condition such as StringNotEquals on aws:RequestedRegion to block all actions in non-approved Regions across every account in the organization. Option B is correct because AWS Config rules can detect resources missing the cost center tag, and with remediation actions (e.g., SSM Automation documents) they can automatically apply the required tag, satisfying the tagging enforcement requirement. Option E is correct because an SCP with a Deny statement using a condition like Null on aws:RequestTag/cost-center (or StringNotEquals) prevents the creation of resources that lack the cost center tag, enforcing tagging at the API level. Option C is not appropriate because IAM policies in each of 200 accounts would require manual, per-account management and do not scale as a centralized guardrail the way SCPs do. Option D is not sufficient because AWS Organizations tag policies only standardize and report on tag usage; they do not enforce or deny the creation of untagged resources.

Answer

Use IAM policies in each account to deny actions in non-approved regions.

Answer

Define a tag policy using AWS Organizations to enforce cost center tags.

Question 13

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

Accepted Answer

Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.. Deploying an AWS Config rule across all accounts using AWS Organizations allows centralized detection of IAM users without MFA, and using AWS Config custom remediation can automatically disable their access keys. This meets the requirement for central management from the management account. Option A is incorrect because SCPs can deny API calls if MFA is not present, but they cannot disable access keys. Option C is incorrect because IAM Access Analyzer is used for analyzing access policies and does not have the capability to enforce MFA or disable keys. Option D is incorrect because AWS IAM Identity Center is designed for workforce identity and access management, not for managing existing IAM users in member accounts.

Answer

Create an SCP that denies all API calls if the user does not have an MFA device.

Answer

Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.

Answer

Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.

Question 14

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

Accepted Answer

The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.. Even though the IAM role in the workload account has permissions to write to the S3 bucket, the KMS key policy in the logging account must explicitly grant the VPC Flow Logs service principal permission to use the key for encryption. Without this key policy statement, the logs cannot be encrypted and delivered. Option A is incorrect because VPC Flow Logs can be delivered directly to S3 without CloudWatch Logs. Option B is incorrect because a bucket policy denying workload accounts would be an issue, but the question states the IAM role has necessary permissions, and the key policy is the missing piece. Option C is incorrect because encryption in transit is not a common requirement for VPC Flow Logs delivery to S3, and the issue is about encryption at rest using KMS.

Answer

The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

Answer

The S3 bucket policy denies access to the workload accounts.

Answer

The S3 bucket has a bucket policy that requires encryption in transit.

Question 15

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

Accepted Answer

Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.. In AWS Organizations, a trail created in the management account logs data events only for resources owned by the management account itself. Data events (S3 object-level operations) are not aggregated across member accounts by a single management-account trail — each member account must create its own trail (or the org trail must be created via CloudTrail organization trails with the correct configuration) to capture data events for its own S3 buckets. This is a fundamental limitation of how CloudTrail scopes data events to the resource owner account.

Answer

The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.

Answer

The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.

Answer

The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.