SAP-C02 Design Solutions for Organizational Complexity Practice Test 14 — 15 Questions

Question 1

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack in each account that creates a bucket with encryption and versioning, and use SCPs to prevent deletion.. Option B is correct because CloudFormation StackSets with service-managed permissions can deploy a standardized bucket template (with SSE and versioning enabled) across every account in the organization, and SCPs can protect that baseline by denying deletion of the stack or bucket. Option C is correct because AWS Config managed rules such as s3-bucket-server-side-encryption-enabled and s3-bucket-versioning-enabled evaluate every bucket in all accounts, and remediation actions (SSM Automation documents) can automatically re-enable encryption and versioning on noncompliant buckets. Option D is correct because an SCP attached at the organization or OU level can deny s3:CreateBucket unless the request includes the required encryption and versioning parameters, preventing noncompliant bucket creation at the API level. Option A is not correct because IAM policies in each account are identity-based and cannot reliably enforce bucket-level configuration defaults across all principals, and they require per-account management rather than centralized governance. Option E is not correct because CloudTrail only records API activity and can send alerts; it does not enforce or remediate encryption and versioning settings.

Answer

Create IAM policies in each account that require encryption and versioning for any bucket creation.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts.

Question 2

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances with an ec2:InstanceType condition key that does not match approved families.. Option B is correct because a service control policy (SCP) applied through AWS Organizations centrally sets the maximum permissions for member accounts, and an explicit Deny on ec2:RunInstances with a StringNotEquals (or similar) condition on the ec2:InstanceType key blocks launching any instance family outside the approved t3 and m5 families. Option E is correct because CloudFormation StackSets deploy a consistent IAM policy to IAM roles/groups across many accounts in the organization, and that policy can include a Deny for ec2:RunInstances conditioned on ec2:InstanceType to restrict developers to approved families. Option A is not correct because AWS Service Catalog only enforces approved products for users who launch through it; it does not prevent developers with direct ec2:RunInstances permissions from launching other instance types. Option C is not correct because an AWS Config rule with a Lambda remediation is detective and reactive—it terminates instances after they are launched rather than preventing unauthorized instance types at the API call. Option D is not correct because creating an IAM role per account is manual and not centrally managed across the organization, and it only restricts users who voluntarily assume that role rather than enforcing the restriction organization-wide.

Answer

Use AWS Service Catalog to create a product that launches approved instances, and require developers to launch only through Service Catalog.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate unauthorized instances.

Answer

Create an IAM role in each account with a policy that restricts instance types, and require developers to use that role.

Question 3

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization.. AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.

Answer

Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.

Answer

Apply an SCP to require CloudTrail to be enabled in all accounts.

Question 4

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Accepted Answer

Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.. VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Answer

Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

Answer

Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

Answer

Place a network load balancer in each VPC and capture traffic using a packet sniffer.

Question 5

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Answer

Create an IAM policy that requires the security group when launching instances with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Answer

Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.

Question 6

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

Accepted Answer

Register the member account as a delegated administrator for CloudTrail in AWS Organizations.. Registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Answer

Create a resource-based policy on the CloudTrail service to allow the member account to create trails.

Answer

Create an IAM role in the management account and grant the developer permission to assume it.

Answer

Attach an SCP to the member account that allows CloudTrail actions.

Question 7

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies creation of S3 buckets without encryption. A service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted buckets

Answer

Enable S3 default encryption in each account

Answer

Use S3 bucket policies to require encryption

Question 8

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

Accepted Answer

Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts. VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket

Answer

Create VPC endpoints in each account to connect to the central S3 bucket

Answer

Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group

Question 9

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID. An SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Answer

Create an EC2 launch template with the approved AMI and share it with all accounts

Answer

Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances

Answer

Use AWS Config rules in each account to detect non-compliant instances and send alerts

Question 10

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Accepted Answer

Attach the SCP to the root organizational unit to apply it to all accounts. Option D is correct because an SCP with a Deny effect on iam:CreateRole conditioned on aws:RequestTag/CostCenter (using a StringNotEquals or Null condition) is the preventive control that blocks role creation without the required tag. Option C is correct because attaching that SCP to the root organizational unit makes it apply to every member account in the organization, which is necessary for a multi-account enforcement. Option E is correct because AWS Config rules (e.g., required-tags or a custom rule) provide detective control and can trigger automatic remediation for existing or non-compliant roles. Option A is not correct because an IAM policy in each account is not an Organizations-level enforcement mechanism and would have to be managed per account. Option B is not correct because AWS Budgets only tracks cost and usage against thresholds and cannot enforce or detect IAM role tagging compliance.

Answer

Create an IAM policy in each account that requires tags on role creation

Answer

Set up AWS Budgets to alert on untagged roles

Question 11

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

Accepted Answer

An IAM policy must be attached to the role granting permissions to the S3 bucket. The IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Answer

A service control policy must allow Lambda to assume roles

Answer

The S3 bucket must have a resource-based policy allowing the Lambda function

Answer

The trust policy must specify the Lambda function name

Question 12

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

Accepted Answer

The IAM role name already exists in the account. The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Answer

The trust policy does not include the correct service principal for EC2

Answer

The template does not have the required IAM capabilities

Answer

The role does not have an instance profile

Question 13

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.. A service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Answer

Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.

Answer

Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.

Question 14

A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.

Answer

Amazon S3 cross-region replication

Answer

Amazon Kinesis Data Firehose

Answer

AWS Config

Question 15

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

Accepted Answer

Use AWS Systems Manager Explorer with multi-account management.. AWS Systems Manager Explorer provides a single-pane-of-glass view across multiple AWS accounts and Regions, allowing the operations team to view and modify EC2 Auto Scaling policies centrally. It integrates with Systems Manager Automation runbooks to execute changes, such as updating scaling policies, across all accounts managed via AWS Organizations.

Answer

Use AWS CloudFormation StackSets to deploy the Auto Scaling groups consistently.

Answer

Use AWS Config rules to enforce desired scaling policies.

Answer

Use Amazon CloudWatch cross-account dashboards.