SAP-C02 Design Solutions for Organizational Complexity Practice Test 12 — 15 Questions

Question 1

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

Accepted Answer

Enable AWS Config in each account and use an aggregator in the security account.. AWS Config aggregator allows viewing compliance from multiple accounts. Option B is wrong because it doesn't aggregate. Option C is wrong because CloudFormation is per-account. Option D is wrong because SCPs cannot enable Config.

Answer

Apply an SCP to enable AWS Config in all accounts.

Answer

Use CloudFormation StackSets to deploy Config rules, then view in each account.

Answer

Enable AWS Config in the security account only and use cross-account roles.

Question 2

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

Accepted Answer

Use AWS RAM to share the subnet with the organization.. AWS Resource Access Manager (RAM) allows sharing subnets securely without VPC peering. Option A is wrong because VPC peering is one-to-one. Option C is wrong because VPN adds complexity. Option D is wrong because it doesn't share the subnet.

Answer

Create a Transit Gateway and attach all accounts.

Answer

Set up a VPN connection between accounts.

Answer

Create a VPC peering connection between each account and the VPC owner.

Question 3

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Accepted Answer

Use IAM roles in each account with cross-account trust from a central identity provider, granting only required permissions.. Using IAM roles with cross-account trust and granting only necessary permissions (option A) and using SCPs to restrict high-risk actions (option D) are correct. Option B is wrong because it grants full access. Option C is wrong because it uses static keys. Option E is wrong because root user should not be used.

Answer

Generate long-term access keys for each user in the central account.

Answer

Share the root user credentials of each account with the central team.

Answer

Create IAM users in each account with full administrator access for all users.

Question 4

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Accepted Answer

A central S3 bucket in the logging account.. A central S3 bucket (option B), a bucket policy that allows cross-account writes (option C), and IAM roles in each account to push logs (option D) are required. Option A is wrong because it's one way but not required if using S3. Option E is wrong because CloudWatch Logs is not required.

Answer

Amazon CloudWatch Logs subscription filter in each account.

Answer

AWS CloudTrail in the central account only.

Question 5

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations SCPs. AWS Config rules (option A) and SCPs (option C) can enforce compliance. Option B is wrong because CloudTrail is logging. Option D is wrong because CloudFormation deploys resources but does not enforce policies. Option E is wrong because VPC Flow Logs are for network logging.

Answer

AWS CloudTrail

Answer

AWS CloudFormation StackSets

Answer

Amazon VPC Flow Logs

Question 6

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.. The SCP denies RunInstances if the instance type is not t2.micro or t2.small. Since t2.medium is not in the allowed list, the action is denied. Option A is wrong because t2.medium is not allowed. Option C is wrong because SCP applies. Option D is wrong because IAM policy does not override SCP.

Answer

The instance launches only if the developer's IAM policy explicitly allows t2.medium.

Answer

The instance launch is allowed because there is no explicit Allow statement in the SCP.

Answer

The instance launches successfully because the SCP does not affect IAM users.

Question 7

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

Accepted Answer

Full access to all AWS services because no SCP is applied to the DevAccount.. SCPs are inherited from the root OU. Since no SCP is attached to the DevAccount or its OU, there is no restriction. Option A is wrong because management account SCP does not apply. Option C is wrong because root user can be restricted by SCP. Option D is wrong because there is no SCP.

Answer

Nothing, because the management account's SCP applies to all accounts.

Answer

Only read-only actions because of default SCP.

Answer

Only actions allowed by the root user's implicit full access.

Question 8

A security engineer created the above bucket policy on the central-logging-bucket in account 111111111111. They want account 222222222222 to deliver CloudTrail logs to this bucket. What is missing?

Accepted Answer

The bucket policy must grant s3:PutObject to the CloudTrail service principal, not to a role.. The bucket policy grants PutObject to a specific role, but CloudTrail requires a bucket policy that grants PutObject to the CloudTrail service principal for cross-account delivery. Option A is wrong because the role exists. Option C is wrong because bucket already exists. Option D is wrong because the prefix is correct for CloudTrail.

Answer

The prefix AWSLogs/111111111111 is incorrect; it should use the source account ID 222222222222.

Answer

The role CrossAccountRole does not exist in account 222222222222.

Answer

The bucket must be in the same account as CloudTrail.

Question 9

A multinational company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled. The company wants to enforce this policy centrally without modifying each bucket individually. Which solution is MOST effective?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless encryption is set.. Option C is correct because using an SCP at the root OU can deny the creation of S3 buckets without encryption across all accounts. Option A is wrong because S3 default encryption is per-bucket and not centrally enforced. Option B is wrong because IAM roles cannot enforce encryption across accounts. Option D is wrong because CloudTrail only logs, not enforces.

Answer

Create an IAM role that all users must assume to create buckets, and attach a policy requiring encryption.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to enable encryption.

Answer

Enable default encryption on each S3 bucket using a custom AWS Config rule.

Question 10

A company uses AWS Organizations with multiple accounts. The central IT team wants to restrict the use of specific EC2 instance types across all accounts to control costs. Which approach should the team use?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for prohibited instance types and apply it to the organization.. Option B is correct because SCPs can deny the launch of specific EC2 instance types. Option A is wrong because IAM policies are per-account and not inherited. Option C is wrong because EC2 billing alerts do not prevent launches. Option D is wrong because CloudWatch Events can only trigger notifications, not deny actions.

Answer

Use AWS Budgets to send alerts when costs exceed a threshold.

Answer

Configure Amazon CloudWatch Events to detect launches and terminate instances.

Answer

Attach an IAM policy to each account's root user to deny the ec2:RunInstances action for certain instance types.

Question 11

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.. Option D is correct because AWS Organizations can automatically create roles via CloudFormation StackSets or AWS CloudFormation in each account, and using a trusted access role simplifies management. Option A is wrong because manual creation does not scale. Option B is wrong because IAM groups are not cross-account. Option C is wrong because SCPs do not create roles.

Answer

Use a service control policy (SCP) to enforce the creation of the role.

Answer

Manually create the same IAM role in each account with a trust policy pointing to the security account.

Answer

Use IAM groups in the security account and grant permissions to the groups.

Question 12

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. Option A is correct because SCPs can deny resource creation without required tags, and AWS Config rules can identify untagged resources. Option B is wrong because SCPs cannot enforce tags on existing resources. Option C is wrong because IAM policies cannot be enforced across accounts easily. Option D is wrong because Cost Explorer can filter by tags but does not enforce tagging.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 13

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

Accepted Answer

Apply an SCP to the root OU that denies the organizations:LeaveOrganization action and denies the root user's ability to perform actions.. Option C is correct because SCPs can deny leaving the organization and restrict root user actions. Option A is wrong because IAM policies cannot restrict root user. Option B is wrong because CloudTrail does not prevent actions. Option D is wrong because AWS Config cannot block actions.

Answer

Create an IAM policy that denies the organizations:LeaveOrganization action and attach it to all IAM users.

Answer

Use AWS Config rules to detect when an account leaves the organization and automatically rejoin it.

Answer

Use AWS CloudTrail to monitor and alert on root user activity and organizations:LeaveOrganization.

Question 14

A company has a central IT team that manages multiple AWS accounts. The team wants to allow developers to create resources in their own accounts but wants to restrict the use of certain expensive services like Amazon Redshift. The developers should not be able to launch Redshift clusters in any account. What is the MOST efficient way to achieve this?

Accepted Answer

Apply an SCP that denies redshift:CreateCluster to the organizational unit containing the developer accounts.. Option A is correct because SCPs can deny the redshift:CreateCluster action across all accounts in the organization. Option B is wrong because IAM policies in each account require manual setup. Option C is wrong because AWS Config cannot deny actions. Option D is wrong because CloudTrail does not prevent actions.

Answer

Use AWS CloudTrail to monitor cluster creation and alert the security team.

Answer

Create an IAM policy that denies redshift:CreateCluster and attach it to the developers' IAM groups in each account.

Answer

Use AWS Config rules to detect Redshift cluster creation and automatically delete them.

Question 15

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.. Option D is correct because AWS CloudFormation StackSets can deploy the flow log configuration to all accounts and regions, and a central S3 bucket policy allows cross-account delivery. Option A is wrong because manual creation does not scale. Option B is wrong because SCPs cannot create resources. Option C is wrong because AWS Config can detect but not automatically enable in all regions easily.

Answer

Use AWS Config rules to detect missing flow logs and send alerts to the security team.

Answer

Use an SCP to require that VPC flow logs be enabled.

Answer

Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.