SAP-C02 Design Solutions for Organizational Complexity Practice Test 12 — 15 Questions

Question 1

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SQS dead-letter queue for failed messages.. An SQS dead-letter queue (DLQ) captures messages that cannot be processed successfully after the maximum retries are exhausted, preventing event loss during traffic spikes. This ensures that failed messages are preserved for later analysis or reprocessing, which is critical for reliability in a serverless event-driven architecture.

Answer

Increase the SQS visibility timeout to 30 minutes.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Set Lambda reserved concurrency to a low value to control costs.

Question 2

A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?

Accepted Answer

A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.. Cross-account IAM role access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal, and an IAM policy in the source account that grants the sts:AssumeRole action for that role's ARN. This two-part configuration establishes a secure delegation path where the dev account's users or roles can request temporary credentials from the production account via the AWS Security Token Service (STS).

Answer

A role in the dev account with permissions to access production resources.

Answer

An IAM user in the production account with permissions to switch roles.

Answer

An SCP that allows sts:AssumeRole from the dev account.

Question 3

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

Accepted Answer

Enable default encryption with SSE-S3 or SSE-KMS.. Enabling default encryption with SSE-S3 or SSE-KMS ensures that all objects written to the S3 bucket are automatically encrypted at rest, protecting sensitive data even if the uploader does not explicitly request encryption. This is a foundational security control that mitigates the risk of data exposure due to misconfigured uploads or accidental storage of unencrypted data.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure a lifecycle policy to transition objects to Glacier.

Answer

Enable S3 Select to filter data.

Question 4

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

Accepted Answer

Use Amazon EventBridge for event-driven integration.. Amazon EventBridge provides a fully managed event bus that decouples microservices by enabling event-driven communication. Services publish events to EventBridge, which then routes them to appropriate consumers based on rules, eliminating direct dependencies between producers and consumers.

Answer

Use AWS Direct Connect for private connectivity.

Answer

Use Elastic Load Balancing to distribute traffic.

Question 5

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account log groups.. Amazon CloudWatch Logs supports cross-account log groups, allowing you to stream log data from multiple AWS accounts into a centralized CloudWatch Logs account. This is achieved by configuring destination policies and subscription filters that forward log events across accounts, enabling unified monitoring and alerting without needing to aggregate logs into a single bucket.

Answer

Amazon SQS.

Answer

AWS CloudFormation.

Answer

Amazon Kinesis Data Firehose.

Question 6

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.. An SCP applied to the root OU is the most efficient way to enforce a blanket denial of public access to S3 buckets across all accounts in AWS Organizations. It prevents any account, including root users, from performing the s3:PutBucketPublicAccessBlock action, ensuring compliance without per-account configuration or remediation.

Answer

Use AWS Config rules to detect and remediate public buckets in each account.

Answer

Create a CloudFormation StackSet to deploy bucket policies in every account.

Answer

Use IAM roles to restrict users from modifying bucket public access settings.

Question 7

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

Accepted Answer

Apply an SCP that allows EC2 actions only in the allowed Regions.. Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.

Answer

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Answer

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Answer

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Question 8

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

Accepted Answer

Apply an SCP that denies the organizations:LeaveOrganization action.. A Service Control Policy (SCP) applied at the root or OU level in AWS Organizations can explicitly deny the `organizations:LeaveOrganization` action for all member accounts. SCPs are the only mechanism that can centrally restrict what actions accounts can perform, including leaving the organization, regardless of the permissions granted by IAM policies within those accounts.

Answer

Configure IAM policies on the root user of each account to deny leave actions.

Answer

Create an AWS Config rule to detect leave attempts.

Answer

Enable AWS CloudTrail to monitor leave events and send alerts.

Question 9

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

Accepted Answer

Use a CloudFormation StackSet to deploy VPC Flow Logs to an S3 bucket in the central account using bucket policies.. Using a CloudFormation StackSet allows you to deploy VPC Flow Logs consistently across multiple accounts and regions, publishing them to a centralized S3 bucket in the logging account. Bucket policies grant cross-account write access, making this approach highly scalable without per-account agent management or CloudWatch Logs cross-account limitations.

Answer

Deploy a third-party log collector agent on each EC2 instance.

Answer

Configure AWS Transit Gateway to aggregate flow logs.

Answer

Enable VPC Flow Logs in each account and publish to a CloudWatch Logs group in the central account.

Question 10

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

Accepted Answer

Apply an SCP that denies ec2:RunInstances unless the request includes the CostCenter tag.. An SCP that denies ec2:RunInstances unless the request includes the CostCenter tag enforces tag propagation at the point of resource creation. This is a preventive control that blocks non-compliant actions before they happen, ensuring all EC2 instances are tagged from the start. It leverages AWS Organizations to apply the policy across all accounts in the specified OUs, providing centralized enforcement without relying on post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on provisioned products.

Answer

Run a Lambda function that tags resources after creation based on the creator's cost center.

Answer

Use AWS Config rules to mark non-compliant resources and auto-remediate.

Question 11

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

Accepted Answer

Create an IAM policy that denies EC2 actions unless the region is us-east-1.. An IAM policy with a Deny effect for ec2:RunInstances when the region is not us-east-1 directly prevents developers from launching EC2 instances in any other region. This is the simplest approach as it uses native IAM condition keys (aws:RequestedRegion) without requiring additional services or complex configurations.

Answer

Use AWS Config to terminate instances in other Regions.

Answer

Apply an SCP to the account.

Answer

Configure the default VPC in us-east-1 only.

Question 12

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

Accepted Answer

Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.. An SCP applied at the root or OU level can deny ec2:RunInstances unless the ec2:ImageId matches a specific set of allowed AMIs. This scales to 500 accounts without per-account configuration, as SCPs are inherited by all accounts in the organization. The condition key ec2:ImageId supports wildcard patterns or a list of AMI IDs, making it a centralized, preventive control.

Answer

Use AWS Config to detect non-compliant AMIs and stop the instances.

Answer

Create a service catalog product for EC2 with allowed AMIs.

Answer

Use AWS Systems Manager to enforce AMI compliance.

Question 13

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

Accepted Answer

Enable AWS Config in each account and use an aggregator in the security account.. AWS Config must be enabled in each individual account to record resource configurations and evaluate rules. An aggregator in the security account can then collect compliance data from all accounts, enabling centralized viewing and management of Config rules without needing to log into each account separately.

Answer

Apply an SCP to enable AWS Config in all accounts.

Answer

Use CloudFormation StackSets to deploy Config rules, then view in each account.

Answer

Enable AWS Config in the security account only and use cross-account roles.

Question 14

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

Accepted Answer

Use AWS RAM to share the subnet with the organization.. AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Answer

Create a Transit Gateway and attach all accounts.

Answer

Set up a VPN connection between accounts.

Answer

Create a VPC peering connection between each account and the VPC owner.

Question 15

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Accepted Answer

Use IAM roles in each account with cross-account trust from a central identity provider, granting only required permissions.. Using IAM roles with cross-account trust from a central identity provider (e.g., AWS IAM Identity Center or an external IdP) allows users to assume roles in each account with only the permissions required for their tasks. This eliminates the need for long-term credentials and enables centralized access management while adhering to least-privilege principles. Option B is correct because Service Control Policies (SCPs) are applied at the AWS Organizations level to deny high-risk actions across all accounts, providing a guardrail that enforces least-privilege by preventing even privileged users from performing dangerous operations.

Answer

Generate long-term access keys for each user in the central account.

Answer

Share the root user credentials of each account with the central team.

Answer

Create IAM users in each account with full administrator access for all users.