SAP-C02 Design Solutions for Organizational Complexity Practice Test 13 — 15 Questions

Question 1

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.. Option B is correct because AWS IAM Identity Center (successor to AWS SSO) centrally manages user access across all accounts in AWS Organizations and supports enforcing MFA at the identity source, so users must present MFA before obtaining credentials to access any account's console. Option C is correct because AWS Config rules (e.g., the managed rule mfa-enabled-for-iam-console-access) continuously detect IAM users who have console access without MFA and can trigger automatic remediation via SSM Automation or Lambda, providing detective and corrective enforcement across accounts. Option E is correct because an IAM policy that denies all actions except the MFA-dependent ones when aws:MultiFactorAuthPresent is false (or aws:MultiFactorAuthAge exceeds a threshold) enforces MFA at the API/console level; attaching it to all IAM users in each account blocks console sign-in and actions until MFA is used. Option A is not a valid enforcement step because CloudTrail only logs and alerts on console logins without MFA; it is detective, not preventive, and does not force users to use MFA. Option D is incorrect because SCPs apply only to AWS Organizations accounts and control the maximum permissions for principals in those accounts; they cannot require MFA on IAM users, and MFA conditions in SCPs are not a supported mechanism for enforcing MFA on IAM users.

Answer

Enable CloudTrail to log all console logins and alert if MFA is not used.

Answer

Use a service control policy (SCP) to require MFA on all IAM users.

Question 2

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption. A service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Answer

Use AWS CloudTrail to monitor and alert on bucket creation without encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Define an IAM policy in each account to deny S3:PutBucket without encryption

Question 3

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

Accepted Answer

Use tag policies in AWS Organizations to enforce tagging on new resources. Tag policies in AWS Organizations allow you to define a set of tagging rules that are enforced across all accounts in the organization. When a tag policy is attached to an organizational root, OU, or account, AWS automatically prevents the creation of resources that do not comply with the specified tags, ensuring that all new resources are tagged correctly from the start without requiring manual remediation or custom scripts.

Answer

Use AWS Config rules to identify untagged resources and send alerts

Answer

Attach an SCP that denies all actions if the resource does not have the cost center tag

Answer

Create a Lambda function that runs daily to tag untagged resources

Question 4

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

Accepted Answer

Set up S3 cross-account replication from each account's bucket to the central bucket. S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Answer

Use a Lambda function in each account to copy logs to the central bucket

Answer

Configure VPC Flow Logs in each account to directly deliver to the central bucket

Answer

Use CloudWatch Logs subscription filter to stream logs to the central account

Question 5

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

Accepted Answer

Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account. AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.

Answer

Establish VPC peering between the shared services VPC and each developer VPC

Answer

Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account

Answer

Use AWS Systems Manager to automate domain join with a custom document

Question 6

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present. An S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Answer

Use AWS Config rules to remediate non-compliant objects

Answer

Require users to use pre-signed URLs for uploads

Answer

Attach an SCP that denies s3:PutObject without encryption

Question 7

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

Accepted Answer

Deploy an AWS Config conformance pack across accounts using AWS Organizations.. AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Answer

Use AWS CloudFormation StackSets in each account.

Answer

Create an AWS Lambda function in the management account to enable Config rules.

Answer

Use an SCP to require Config recording.

Question 8

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Answer

Use AWS Lambda to re-enable GuardDuty if it is disabled.

Answer

Create an AWS Config rule to detect disabled GuardDuty and send alerts.

Answer

Attach an IAM policy to each user that denies guardduty:Disable* actions.

Question 9

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

Accepted Answer

Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.. Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Answer

Use S3 object-level compression (e.g., gzip) to reduce data volume.

Answer

Create AWS Glue partition indexes on the table.

Answer

Create separate Athena tables for each account and region.

Question 10

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The users are operating in the management account.. SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Answer

The SCP is attached to the root, not the OU.

Answer

The users have a permissions boundary that allows the actions.

Answer

The SCP's condition key does not match the actual tag.

Question 11

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Accepted Answer

Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.. It uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Answer

Use AWS PrivateLink to connect each VPC to the network account.

Answer

Create VPC peering connections between each VPC and the network account.

Answer

Assign new non-overlapping CIDR ranges to each VPC and update all resources.

Question 12

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

Accepted Answer

Attach an IAM policy to the user that allows s3:GetObject on the bucket.. The simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Answer

Create an IAM role in the source account and have the user assume it.

Answer

Update the bucket policy to allow the user's ARN directly.

Answer

Use a bucket ACL to grant access to the user's canonical ID.

Question 13

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Accepted Answer

Enable CloudTrail organization trail from the management account.. Option A is correct because an organization trail created from the management account in AWS Organizations automatically applies to every account in the organization, including new accounts as they are added, and can deliver logs to a central S3 bucket, satisfying the requirement to enforce CloudTrail across hundreds of accounts. Option E is correct because CloudFormation StackSets with service-managed permissions leverage AWS Organizations to deploy a CloudTrail trail (and its S3 bucket policy, KMS key, etc.) to all accounts in the organization, including automatic deployment to new accounts, providing consistent enforcement. Option B is not ideal because a per-account Lambda function is operationally heavy, must be deployed and maintained in every account, and does not automatically cover new accounts. Option C is incorrect because an SCP can only allow or deny API actions; it cannot itself enable CloudTrail, and there is no SCP condition that turns CloudTrail on. Option D is incorrect because an AWS Config rule only detects and reports noncompliance; it does not enforce or enable CloudTrail, so it fails the 'ensure compliance' requirement.

Answer

Create an AWS Lambda function in each account to enable CloudTrail.

Answer

Attach an SCP that requires CloudTrail to be enabled.

Answer

Create an AWS Config rule to detect accounts without CloudTrail.

Question 14

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Accepted Answer

Share the IPAM pool using AWS Resource Access Manager (RAM).. Option E is correct because cross-account IPAM requires designating a delegated administrator account from within the AWS Organizations management account using the IPAM enable command (aws ec2 enable-ipam-organization-admin-account), which authorizes that account to create and manage IPAMs on behalf of the organization. Option C is correct because after the IPAM and its pools exist in the delegated administrator account, the pools must be shared with the member accounts via AWS Resource Access Manager (RAM) so those accounts can allocate CIDRs from them. Option A is wrong because IPAM does not use AWS PrivateLink endpoints; it is accessed through the EC2 API and the IPAM console. Option B is wrong because VPC sharing (via RAM) shares subnets, not IPAM pools, and is not a prerequisite for cross-account IPAM. Option D is wrong because AWS Direct Connect is a dedicated network connection service and has no role in enabling cross-account IPAM.

Answer

Create a PrivateLink endpoint for IPAM.

Answer

Enable VPC sharing in each member account.

Answer

Set up AWS Direct Connect between accounts.

Question 15

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Answer

Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.

Answer

Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.

Answer

Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.