SAP-C02 Design Solutions for Organizational Complexity Practice Test 13 — 15 Questions

Question 1

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

Accepted Answer

The trail was not created as an organization trail.. Option B is correct because a single trail in the management account can log events for all member accounts only if CloudTrail is configured to include all accounts (organization trail). Option A is wrong because SCPs do not affect CloudTrail logging. Option C is wrong because CloudTrail is not a regional service; organization trails log all regions. Option D is wrong because IAM permissions do not affect logging once the trail is configured.

Answer

The SCPs applied to member accounts are blocking CloudTrail from sending logs.

Answer

CloudTrail is a regional service and the trail is only in one region.

Answer

Member accounts have IAM policies that deny CloudTrail logging.

Question 2

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users are created in member accounts. All access must be through federated roles. Which approach should they use?

Accepted Answer

Apply an SCP to the root OU that denies the iam:CreateUser action.. Option C is correct because an SCP can deny the iam:CreateUser action across all member accounts. Option A is wrong because IAM password policies do not prevent user creation. Option B is wrong because AWS Config can detect but not prevent. Option D is wrong because CloudTrail only logs.

Answer

Set an IAM password policy in each account that requires strong passwords.

Answer

Use AWS Config rules to detect IAM users and automatically delete them.

Answer

Use AWS CloudTrail to monitor for CreateUser and alert the security team.

Question 3

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

Accepted Answer

Create an SCP that denies ec2:RunInstances unless the ami id matches an approved list.. Options A and D are correct. An SCP can deny the ec2:RunInstances action if the AMI ID is not in an approved list, and AWS Config can detect noncompliant instances. Option B is wrong because AMI IDs are account-specific and shared via RAM. Option C is wrong because IAM policies cannot enforce specific AMIs across accounts easily. Option E is wrong because CloudTrail does not prevent launches.

Answer

Use AWS Resource Access Manager to share the approved AMI with all accounts.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Attach an IAM policy to each account's IAM roles that allows only approved AMIs.

Question 4

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Accepted Answer

Create a StackSet with the template and target the OU, enabling automatic deployment.. Options A, C, and D are correct. AWS CloudFormation StackSets allow deploying templates to multiple accounts and regions; enabling trusted access allows StackSets to work with Organizations; adding new accounts to the OU triggers automatic deployment if StackSets are configured with automatic deployment. Option B is wrong because SCPs cannot create resources. Option E is wrong because AWS Config cannot create resources.

Answer

Use AWS Config rules to detect missing resources and deploy them via Lambda.

Answer

Create an SCP that requires the creation of those resources.

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally manage CloudWatch Logs from all accounts. The logs should be sent to a central S3 bucket in the management account. Which two actions should the team take? (Choose two.)

Accepted Answer

Create a subscription filter in each member account's log groups that sends logs to the central S3 bucket.. Options A and C are correct. The management account must create a subscription filter policy in each account (or use cross-account subscription), and the S3 bucket policy must allow cross-account writes. Option B is wrong because SCPs cannot create log delivery. Option D is wrong because IAM roles in member accounts are needed for the subscription, not for the bucket. Option E is wrong because CloudWatch Logs does not natively send to S3 without subscription filters.

Answer

Create an IAM role in the management account that can read logs from member accounts.

Answer

Apply an SCP that requires all log groups to export logs to the central bucket.

Answer

Use AWS CloudTrail to deliver logs to the central bucket.

Question 6

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

Accepted Answer

The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.. Option D is correct because the user must have permission from the management account to assume the role, and the role itself must trust the management account. The policy shown is correct, but the role in the member account must have a trust policy that allows the management account to assume it. Option A is wrong because SCPs can deny but not the primary issue. Option B is wrong because IAM roles are not regional. Option C is wrong because the policy allows all accounts.

Answer

The IAM role does not exist in the same region as the user.

Answer

An SCP in the member account denies the sts:AssumeRole action.

Answer

The policy does not specify the exact member account ARN.

Question 7

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

Accepted Answer

The SCP policy document does not contain a Deny statement for the regions.. Option B is correct because the SCP shown is only a list of policies; the actual policy content (the statement) is not displayed. It is possible that the SCP does not contain the intended deny rule or has an Allow effect that overrides. Option A is wrong because SCPs affect all users, including root. Option C is wrong because SCPs can deny actions based on region conditions. Option D is wrong because SCPs apply to all services uniformly unless specified otherwise.

Answer

The SCP is not applied to the root user of the member account.

Answer

The SCP cannot restrict actions based on region.

Answer

The SCP is overridden by an Allow policy attached to the account.

Question 8

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

Accepted Answer

The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.. Option C is correct because the SCP only denies s3:PutObject if the encryption is not AES256. However, if users use s3:PutObject with encryption set to aws:kms, the condition StringNotEquals evaluates to true (since 'AES256' != 'aws:kms'), so the Deny applies. Wait: actually, the condition denies if encryption is NOT AES256, so both 'aws:kms' and no encryption would be denied. But if users use SSE-S3 (AES256), it's allowed. The problem is that users are able to upload without encryption. That means the Deny is not taking effect. The most likely reason is that the SCP is not attached to the OU, or the users are using Multipart Upload (s3:PutObjectPart) which is a different action. Option A is wrong because SSE-C is also not AES256. Option B is wrong because they are not using SSE-S3. Option D is wrong because the SCP does not deny s3:PutObject without encryption? Actually, the condition denies if encryption is not AES256, so it should deny unencrypted uploads. But if users use Multipart Upload, the action is s3:UploadPart, not s3:PutObject. So the SCP does not cover that.

Answer

The users are using SSE-S3 encryption (AES256).

Answer

The SCP is missing a Deny for s3:PutObject without any encryption header.

Answer

The users are using SSE-C encryption.

Question 9

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. Option B is correct because AWS Organizations can be used with AWS CloudFormation StackSets to automatically deploy and manage security configurations across accounts. Option A is wrong because custom scripts require ongoing maintenance. Option C is wrong because Service Catalog requires user action to provision. Option D is wrong because AWS Config conformance packs do not automatically apply to new accounts without additional setup.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 10

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.. Option D is correct because AWS Transit Gateway allows you to create separate route tables per VPC attachment, and you can associate a network ACL (or security group) at the VPC level to control traffic between specific VPCs. Option A is wrong because VPC endpoints are for accessing AWS services privately. Option B is wrong because a single route table would allow all VPCs to communicate. Option C is wrong because VPC peering does not provide central management.

Answer

Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

Answer

Create VPC peering connections between all VPCs and use route tables to control access.

Answer

Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

Question 11

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.. Option A is correct because SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because service control policies are the right mechanism.

Answer

Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

Answer

Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

Answer

Use AWS Systems Manager to enforce the AMI ID requirement.

Question 12

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

Accepted Answer

Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.. Option C is correct because AWS CloudTrail can be enabled at the organization level, which automatically creates a trail for all accounts and regions, including future accounts. Option A is wrong because it requires individual setup. Option B is wrong because enabling CloudTrail per account is operationally heavy. Option D is wrong because security groups do not log API calls.

Answer

Use AWS Config to record API calls and deliver to a central S3 bucket.

Answer

Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.

Answer

Use VPC Flow Logs to capture API calls and send to a central S3 bucket.

Question 13

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.. Option B is correct because SCPs can deny EC2:RunInstances if the NetworkInterface has AssociatePublicIpAddress set to true. Option A is wrong because IAM policies can be overridden by service-linked roles. Option C is wrong because the 'Block public access' feature is for S3. Option D is wrong because it is detective, not preventive.

Answer

Use the Amazon EC2 'Block public access' feature at the account level.

Answer

Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.

Answer

Use AWS Config to detect instances with public IPs and automatically terminate them.

Question 14

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

Accepted Answer

Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.. Option D is correct because AWS Organizations allows you to consolidate billing and share Reserved Instance discounts across all accounts. Option A is wrong because each account would need to purchase separately, losing optimization. Option B is wrong because EC2 Reserved Instance Marketplace is for selling unused reservations. Option C is wrong because AWS Budgets is for cost tracking, not purchasing.

Answer

Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

Answer

Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

Answer

Have each account purchase its own Reserved Instances based on its usage.

Question 15

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

Accepted Answer

Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.. Option A is correct because resource-based policies can be attached to VPCs to control deletion. SCPs can also be used but are account-wide. Option B is wrong because SCPs would restrict all accounts. Option C is wrong because IAM policies cannot restrict by resource tag without a specific condition. Option D is wrong because AWS Config does not prevent deletion.

Answer

Use AWS Config rules to automatically recreate any VPC that is deleted.

Answer

Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

Answer

Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.