SAP-C02 Design Solutions for Organizational Complexity Practice Test 13 — 15 Questions

Question 1

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Accepted Answer

A central S3 bucket in the logging account.. A central S3 bucket in a dedicated logging account is the foundational component for aggregating logs from multiple AWS accounts. This bucket serves as the single destination for all log data, enabling centralized storage, analysis, and retention without exposing logs to individual source accounts.

Answer

Amazon CloudWatch Logs subscription filter in each account.

Answer

AWS CloudTrail in the central account only.

Question 2

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations SCPs. AWS Organizations Service Control Policies (SCPs) allow you to centrally control the maximum available permissions for all accounts, enabling automated enforcement of compliance policies by restricting actions across multiple accounts without per-account configuration. AWS Config rules allow you to define rules that evaluate resource configurations against desired policies and can trigger automatic remediation actions, enforcing compliance across accounts when integrated with AWS Organizations.

Answer

AWS CloudTrail

Answer

AWS CloudFormation StackSets

Answer

Amazon VPC Flow Logs

Question 3

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.. The SCP explicitly denies all EC2 instance types except t2.micro and t2.small. Since t2.medium is not in the allowed list, the deny effect applies, and the instance launch is blocked. SCPs act as a guardrail that overrides any Allow in IAM policies within the affected accounts.

Answer

The instance launches only if the developer's IAM policy explicitly allows t2.medium.

Answer

The instance launch is allowed because there is no explicit Allow statement in the SCP.

Answer

The instance launches successfully because the SCP does not affect IAM users.

Question 4

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

Accepted Answer

Nothing, because the management account's SCP applies to all accounts.. SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.

Answer

Full access to all AWS services because no SCP is applied to the DevAccount.

Answer

Only read-only actions because of default SCP.

Answer

Only actions allowed by the root user's implicit full access.

Question 5

A security engineer created the above bucket policy on the central-logging-bucket in account 111111111111. They want account 222222222222 to deliver CloudTrail logs to this bucket. What is missing?

Accepted Answer

The bucket policy must grant s3:PutObject to the CloudTrail service principal, not to a role.. CloudTrail delivers logs to S3 buckets by assuming a service-linked role, but the bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) rather than to an IAM role in the target account. This is because CloudTrail uses its own service principal to write logs, not a cross-account IAM role. Without this permission, the CloudTrail delivery will fail with an access denied error.

Answer

The prefix AWSLogs/111111111111 is incorrect; it should use the source account ID 222222222222.

Answer

The role CrossAccountRole does not exist in account 222222222222.

Answer

The bucket must be in the same account as CloudTrail.

Question 6

A company uses AWS Organizations with multiple accounts. The central IT team wants to restrict the use of specific EC2 instance types across all accounts to control costs. Which approach should the team use?

Accepted Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action for prohibited instance types and apply it to the organization.. Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts in an AWS Organization. By creating an SCP that denies the ec2:RunInstances action for specific instance types and applying it to the organization (or relevant OUs), the central IT team can enforce this restriction globally, preventing any IAM principal in any account from launching prohibited instance types, regardless of their IAM permissions.

Answer

Use AWS Budgets to send alerts when costs exceed a threshold.

Answer

Configure Amazon CloudWatch Events to detect launches and terminate instances.

Answer

Attach an IAM policy to each account's root user to deny the ec2:RunInstances action for certain instance types.

Question 7

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.. AWS CloudFormation StackSets allows you to deploy the same IAM role across multiple accounts in an AWS Organization in a single, automated operation. By enabling trusted access with AWS Organizations, the role can be centrally managed and automatically deployed to new accounts as they are added, ensuring the solution scales without manual intervention.

Answer

Use a service control policy (SCP) to enforce the creation of the role.

Answer

Manually create the same IAM role in each account with a trust policy pointing to the security account.

Answer

Use IAM groups in the security account and grant permissions to the groups.

Question 8

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 9

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

Accepted Answer

Apply an SCP to the root OU that denies the organizations:LeaveOrganization action and denies the root user's ability to perform actions.. An SCP attached to the root OU can deny the organizations:LeaveOrganization action for all accounts in the organization, preventing any account from leaving. Additionally, an SCP can deny all actions for the root user in member accounts by using a condition key such as "aws:PrincipalType": "Root", which effectively blocks root user operations without affecting IAM users or roles. This approach enforces both requirements centrally without requiring per-account configuration.

Answer

Create an IAM policy that denies the organizations:LeaveOrganization action and attach it to all IAM users.

Answer

Use AWS Config rules to detect when an account leaves the organization and automatically rejoin it.

Answer

Use AWS CloudTrail to monitor and alert on root user activity and organizations:LeaveOrganization.

Question 10

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.. AWS CloudFormation StackSets can deploy a VPC flow log configuration across multiple accounts and regions in an AWS Organization, and the central S3 bucket policy must allow cross-account delivery from all accounts. This approach automates the deployment for new accounts as they are added to the organization, meeting the requirement for centralized management and automation.

Answer

Use AWS Config rules to detect missing flow logs and send alerts to the security team.

Answer

Use an SCP to require that VPC flow logs be enabled.

Answer

Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

Question 11

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

Accepted Answer

The trail was not created as an organization trail.. When a CloudTrail trail is created in the management account without enabling the 'organization trail' option, it only logs events for the management account itself and not for member accounts. To centralize logging across all accounts in AWS Organizations, the trail must be explicitly created as an organization trail, which automatically applies to all current and future member accounts. Without this setting, member account events are not forwarded to the management account's trail.

Answer

The SCPs applied to member accounts are blocking CloudTrail from sending logs.

Answer

CloudTrail is a regional service and the trail is only in one region.

Answer

Member accounts have IAM policies that deny CloudTrail logging.

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users are created in member accounts. All access must be through federated roles. Which approach should they use?

Accepted Answer

Apply an SCP to the root OU that denies the iam:CreateUser action.. Service Control Policies (SCPs) in AWS Organizations allow the security team to centrally restrict permissions across all member accounts. By applying an SCP to the root organizational unit (OU) that denies the `iam:CreateUser` action, no IAM users can be created in any member account, ensuring all access must come from federated roles. SCPs are evaluated before IAM policies and cannot be overridden by account administrators, making them the most effective preventive control.

Answer

Set an IAM password policy in each account that requires strong passwords.

Answer

Use AWS Config rules to detect IAM users and automatically delete them.

Answer

Use AWS CloudTrail to monitor for CreateUser and alert the security team.

Question 13

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

Accepted Answer

Create an SCP that denies ec2:RunInstances unless the ami id matches an approved list.. An SCP in AWS Organizations can deny the ec2:RunInstances action unless the request includes an approved AMI ID, using a condition key like ec2:ImageId. This enforces the policy across all accounts in the organization, preventing any non-approved AMI from being used even by administrators. Option C is correct because AWS Config rules can detect non-compliant instances (e.g., those launched with unapproved AMIs) and trigger an automatic remediation action, such as terminating the instance or sending notifications, providing a detective and corrective control.

Answer

Use AWS Resource Access Manager to share the approved AMI with all accounts.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Attach an IAM policy to each account's IAM roles that allows only approved AMIs.

Question 14

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Accepted Answer

Create a StackSet with the template and target the OU, enabling automatic deployment.. AWS CloudFormation StackSets allow you to deploy a common CloudFormation template across multiple accounts and regions. By targeting an organizational unit (OU) and enabling automatic deployment, any new account added to that OU will automatically receive the defined resources, fulfilling the automation requirement.

Answer

Use AWS Config rules to detect missing resources and deploy them via Lambda.

Answer

Create an SCP that requires the creation of those resources.

Question 15

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

Accepted Answer

The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.. The OrganizationAccountAccessRole in the member account must have a trust policy that explicitly allows the management account's IAM user (or the management account itself) to assume the role. Without this trust relationship, the sts:AssumeRole call from the management account user will be denied, even if the user's IAM policy grants permission to assume the role.

Answer

The IAM role does not exist in the same region as the user.

Answer

An SCP in the member account denies the sts:AssumeRole action.

Answer

The policy does not specify the exact member account ARN.