SAP-C02 Design Solutions for Organizational Complexity Practice Test 12 — 15 Questions

Question 1

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.. AWS Systems Manager Run Command allows you to run commands on EC2 instances across multiple accounts and Regions using resource groups that select instances by tags. It supports cross-account execution when integrated with AWS Organizations and a central management account, and it can run a script once immediately. The shared S3 bucket in the management account can be accessed by the instances if they have the appropriate IAM permissions, which can be configured via a service role. This solution has the least operational overhead because it uses native SSM capabilities without custom code.

Answer

Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

Answer

Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

Answer

Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

Question 2

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

Accepted Answer

Each member account must individually configure the S3 bucket as a publishing destination for its own findings.. In GuardDuty, each member account must individually configure the S3 bucket as a publishing destination for its own findings. The management account's configuration does not propagate to member accounts. Even though the bucket policy allows the GuardDuty service principal, member accounts must set up their own export settings to send findings to the central bucket.

Answer

The GuardDuty detector in the management account is not configured to publish findings to S3.

Answer

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Answer

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

Question 3

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS Backup with a backup policy in AWS Organizations to centrally manage backups across accounts.. AWS Backup with a backup policy in AWS Organizations is the only solution that centrally manages backup plans across multiple accounts from the management account. The backup policy can define a backup plan that targets resources by tag (e.g., Backup=Weekly) and automatically applies it to all accounts in the organization. It also supports storing backups in a central vault in the management account via cross-account backup, which is a native feature of AWS Backup.

Answer

Create a backup plan in each account targeting the tagged instances and store backups in the management account's vault using cross-account backup.

Answer

Use AWS CloudFormation StackSets to deploy a backup plan to each account.

Answer

Use Amazon Data Lifecycle Manager to create cross-account snapshot copies for tagged instances.

Question 4

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The workload accounts have not accepted the resource share invitation.. AWS RAM requires workload accounts to accept the resource share invitation before they can see and use the shared subnet. Option B is incorrect because having a default VPC in the workload account does not prevent visibility of shared subnets; the subnet will appear in the VPC list regardless. Option C is incorrect because the primary issue is the acceptance of the resource share, not IAM permissions; while IAM permissions may be needed to launch instances, the subnet itself will not be visible until the share is accepted. Option D is incorrect because AWS RAM supports sharing across regions, so a different region would not prevent the subnet from being visible after acceptance.

Answer

The workload accounts have a default VPC that conflicts with the shared subnet.

Answer

The workload accounts do not have the necessary IAM permissions to use shared subnets.

Answer

The subnet is in a different AWS Region than the workload accounts.

Question 5

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.. When a trail in the management account is configured as an organization trail, CloudTrail creates the trail in every member account and delivers logs to the central S3 bucket. However, the S3 bucket policy must explicitly grant the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write, and it must account for the source account/ARN of each member account's CloudTrail. If the bucket policy only allows the management account's CloudTrail to write, member account log delivery will be denied with AccessDenied, which is the most likely cause here.

Answer

CloudTrail cannot log management events for member accounts from the management account.

Answer

The trail is configured to log only read events.

Answer

The member accounts have disabled CloudTrail.

Question 6

A company uses AWS Organizations and has a central security account. They want to use AWS Security Hub to aggregate findings from all member accounts. They have enabled Security Hub in the security account and invited all member accounts. However, findings from member accounts are not appearing in the Security Hub console of the security account. What is the most likely cause?

Accepted Answer

The member accounts have not enabled Security Hub and accepted the invitation.. Each member account must enable Security Hub and accept the invitation before findings are aggregated. Option A is wrong because Security Hub supports cross-region aggregation. Option B is wrong because IAM permissions are needed but not the primary cause. Option C is wrong because there is no such requirement.

Answer

The member accounts have not configured Security Hub to send findings to the security account.

Answer

The IAM role used by Security Hub in the security account does not have permissions to read findings from member accounts.

Answer

Security Hub cannot aggregate findings from member accounts in different regions.

Question 7

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AD Connector. AWS Managed Microsoft AD (E) is correct because it is a fully managed Microsoft Active Directory in AWS that supports multi-region replication, enabling highly available and low-latency authentication for thousands of users while allowing trust relationships with the existing on-premises AD for seamless SSO. AD Connector (C) is correct because it provides a directory gateway that proxies authentication requests to the on-premises Active Directory, letting AWS workloads and services use existing AD credentials without replicating directory data, which supports integration and SSO with the on-premises environment. Together, AWS Managed Microsoft AD can host AWS-side identities and trusts while AD Connector bridges to on-premises AD, meeting the multi-region, HA, low-latency, and SSO requirements. Amazon Cognito (A) is for customer-facing web and mobile app identity (user pools/federated identities), not for extending corporate AD authentication for AWS workloads. AWS Direct Connect (B) is a dedicated network connection and does not itself provide directory authentication or SSO. AWS Single Sign-On (D) is an access management/SSO portal service, but it is not the directory service that provides the AD authentication and multi-region directory capability required here.

Answer

Amazon Cognito

Answer

AWS Direct Connect

Answer

AWS Single Sign-On (SSO)

Question 8

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

Accepted Answer

Create an organization trail in CloudTrail and store logs in the central bucket. Attach an SCP to the root that denies s3:PutBucketPolicy for the central bucket.. AWS Organizations allows you to create service control policies (SCPs) that can deny actions across accounts. Using an SCP to deny the s3:PutBucketPolicy action on the central bucket ensures that no account can change the bucket policy to block log delivery. Additionally, enabling CloudTrail for all regions and all accounts with an organization trail ensures automatic log delivery. Option C meets both requirements.

Answer

Set up VPC Flow Logs at the VPC level and CloudTrail at the account level, then use Lambda to copy logs to the central bucket.

Answer

Use AWS Config rules to detect when logs are not being sent and automatically re-enable logging.

Answer

Create individual trails per account and use S3 cross-region replication to copy logs to the central bucket.

Question 9

A large enterprise with multiple business units (BUs) uses AWS Organizations with a shared services account and BU-specific accounts. Each BU account has a VPC with multiple subnets. The shared services account hosts a central NAT gateway that provides outbound internet access to all BU private subnets via VPC peering. Recently, the network team noticed that traffic from one BU's private subnet is being blocked by the security group in the shared services account. They verified that the route tables are correctly configured. What is the most likely cause and solution?

Accepted Answer

The VPC peering connection is not in the 'active' state. Recreate the VPC peering connection.. VPC peering connections must be in the 'active' state to route traffic between VPCs. If the peering connection for a specific BU's VPC is not active (e.g., pending acceptance, expired, or deleted), traffic from that BU's private subnet to the shared services VPC will be blocked. Since route tables and the NAT gateway's configuration are correct, the most likely cause is an inactive VPC peering connection. Option B is incorrect because NAT gateways do not support user-modifiable security groups; AWS manages the security group on the NAT gateway's ENI and it cannot be updated by customers. Option A contradicts the verified route tables. Option D would affect all BUs, not just one.

Answer

The BU account's route table does not have a route to the NAT gateway's private IP. Add a route via the VPC peering connection.

Answer

The security group attached to the NAT gateway's ENI does not allow incoming traffic from the BU private subnet. Update the security group to allow inbound traffic from the BU subnet CIDR.

Answer

The NAT gateway's Elastic IP is not attached. Attach an Elastic IP to the NAT gateway.

Question 10

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

Accepted Answer

Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.. The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag. Option C allows the services to bypass the tag requirement.

Answer

Remove the SCP from the root.

Answer

Modify the bucket policy to allow s3:PutObject without tags.

Answer

Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

Question 11

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

Accepted Answer

Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.. AWS Organizations Service Control Policies (SCPs) can deny the creation of CloudFormation stacks that do not include required stack-level tags, while stack-level tags defined in the template propagate to all resources created by the stack. This combination enforces tagging standards across all stacks without relying on individual IAM user permissions or post-creation remediation.

Answer

Create an IAM policy that requires tags on all resources and attach it to all IAM users.

Answer

Configure CloudFormation to reject any stack that does not include tags.

Answer

Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.

Question 12

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

Accepted Answer

Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.. AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.

Answer

Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.

Answer

Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.

Answer

Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.

Question 13

An organization uses AWS Organizations with a multi-account strategy. The security team needs to ensure that all accounts must use AWS CloudTrail with logs delivered to a centralized S3 bucket. They also want to receive notifications if any account disables CloudTrail. What is the MOST efficient solution?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Use an S3 event notification on the centralized bucket to trigger a Lambda function that sends an SNS alert if logs stop arriving.. The SCP blocks disabling actions. To detect if logs stop arriving, a scheduled CloudWatch Events rule invokes a Lambda function that calls the DescribeTrails API and checks the last log delivery time. If logs have not been delivered recently, an SNS alert is sent. This combined approach provides both prevention and detection.

Answer

Use AWS CloudTrail to log management events and set up a CloudWatch Events rule that triggers on StopLogging API calls.

Answer

Use an SCP that requires all accounts to have a specific trust policy for CloudTrail. Use CloudTrail Insights to detect anomalous activity.

Answer

Deploy a Lambda function in each account that periodically checks CloudTrail status and sends an SNS message if disabled.

Question 14

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.. An IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Answer

Create a service control policy in AWS Organizations that restricts instance types for all accounts.

Answer

Use AWS Config to automatically terminate instances that are not of allowed types.

Answer

Configure an S3 bucket policy that only allows specific instance types to be used.

Question 15

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

Accepted Answer

Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.. It uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Answer

Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.

Answer

Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.

Answer

Share the EC2 console credentials of each account with the DevOps team.