SAP-C02 Design Solutions for Organizational Complexity Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP policy document does not contain a Deny statement for the regions.. The SCP policy document must explicitly include a Deny statement with a condition that restricts actions to only us-east-1 and eu-west-1. Without a Deny statement, the SCP is effectively permissive (Allow) by default, meaning it does not block actions in other regions. The SCP in the exhibit likely only has Allow statements for the two allowed regions, which does not prevent actions in ap-southeast-1.

Answer

The SCP is not applied to the root user of the member account.

Answer

The SCP cannot restrict actions based on region.

Answer

The SCP is overridden by an Allow policy attached to the account.

Question 2

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

Accepted Answer

The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.. The SCP likely denies s3:PutObject unless encryption headers are present, but the Multipart Upload API uses the s3:UploadPart action for uploading individual parts. Since the SCP only denies s3:PutObject without encryption, the s3:UploadPart action is not covered, allowing unencrypted uploads via multipart uploads. This is why users can still upload objects without encryption despite the SCP.

Answer

The users are using SSE-S3 encryption (AES256).

Answer

The SCP is missing a Deny for s3:PutObject without any encryption header.

Answer

The users are using SSE-C encryption.

Question 3

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 4

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.. It uses a central transit gateway with separate route tables for each VPC attachment, which allows the networking team to enable communication between all VPCs via the transit gateway while the security team can isolate specific accounts by controlling which route tables are associated with which VPC attachments. Network ACLs in each VPC provide an additional layer of stateless traffic filtering to restrict traffic between specific VPCs, complementing the route table isolation.

Answer

Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

Answer

Create VPC peering connections between all VPCs and use route tables to control access.

Answer

Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

Question 5

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.. SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because service control policies are the right mechanism.

Answer

Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

Answer

Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

Answer

Use AWS Systems Manager to enforce the AMI ID requirement.

Question 6

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

Accepted Answer

Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.. An organization trail in the management account automatically applies to all existing and future accounts and regions within AWS Organizations, capturing all management events without per-account configuration. It delivers logs to a single S3 bucket, and the bucket policy grants read access to all accounts, making it cost-effective by avoiding duplicate trails and reducing storage overhead.

Answer

Use AWS Config to record API calls and deliver to a central S3 bucket.

Answer

Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.

Answer

Use VPC Flow Logs to capture API calls and send to a central S3 bucket.

Question 7

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.. A service control policy (SCP) attached to the production OU can deny the ec2:RunInstances action when the request includes the AssociatePublicIpAddress=true parameter. This is a preventive control that applies to all accounts in the OU, regardless of IAM permissions, and does not rely on developer compliance.

Answer

Use the Amazon EC2 'Block public access' feature at the account level.

Answer

Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.

Answer

Use AWS Config to detect instances with public IPs and automatically terminate them.

Question 8

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

Accepted Answer

Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.. AWS Organizations with consolidated billing allows Reserved Instance (RI) discounts to be applied across all accounts in the organization. By purchasing RIs in the management account, the finance team can centrally manage and optimize RI purchases, and the hourly cost and usage benefits are shared across all accounts, maximizing utilization and cost savings.

Answer

Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

Answer

Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

Answer

Have each account purchase its own Reserved Instances based on its usage.

Question 9

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

Accepted Answer

Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.. VPCs do not support resource-based policies (making Option B invalid). An IAM policy with a condition based on a tag can effectively restrict deletion. For example, developers can be allowed to delete VPCs only if the VPC has a specific tag (e.g., 'AllowDeletion: true'), which they can add to their own VPCs. Centrally created VPCs would lack this tag, so deletion is denied. This provides granular control without affecting other permissions.

Answer

Use AWS Config rules to automatically recreate any VPC that is deleted.

Answer

Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.

Answer

Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

Question 10

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 11

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

Accepted Answer

AWS IAM Identity Center (AWS SSO).. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user identities and permissions across multiple AWS accounts within an AWS Organization. It allows the security team to create or connect users and groups, and assign them fine-grained permissions to accounts, roles, and applications from a single pane of glass, eliminating the need to create IAM users in each account.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

AWS Identity and Access Management (IAM) in the management account.

Answer

Amazon Cognito user pools.

Question 12

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. A service control policy (SCP) can be applied at the organization, organizational unit (OU), or account level to deny the s3:CreateBucket action unless the request includes the x-amz-bucket-object-lock-enabled header or the bucket is created with default encryption enabled. This enforces encryption at rest for all new S3 buckets across the entire organization. Option E is correct because AWS Config rules can evaluate existing S3 buckets for encryption compliance and trigger an automatic remediation action, such as enabling default encryption via AWS Systems Manager Automation, ensuring both new and existing buckets are encrypted.

Answer

Attach a bucket policy to each bucket that denies PutObject without encryption.

Answer

Create an IAM policy that denies s3:PutObject unless encryption is specified.

Answer

Enable S3 Block Public Access at the organization level.

Question 13

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Accepted Answer

Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.. AWS CloudFormation StackSets allows you to deploy infrastructure as code across multiple accounts and Regions from a single administrative account. By defining a standard VPC and subnet configuration in a CloudFormation template and using StackSets, the central IT team can consistently provision compliant network resources in all accounts, ensuring adherence to the standard.

Answer

Create an IAM role in each account with permissions to manage VPCs.

Answer

Set up AWS Lambda functions to terminate noncompliant VPCs daily.

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.. Amazon CloudTrail logs root user login events as 'RootLogin' events, which can be captured by an Amazon CloudWatch Events rule (now Amazon EventBridge). This rule can trigger an Amazon SNS notification to alert the security team in real time, ensuring immediate awareness of root activity. Option D is correct because AWS CloudTrail must be enabled in all accounts to record root user API calls; without CloudTrail, there is no audit trail for root actions, making monitoring impossible.

Answer

Use AWS Config rules to detect root user usage.

Answer

Create an IAM role for root user with limited permissions.

Answer

Attach a service control policy (SCP) to all accounts to deny root user actions.

Question 15

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

Accepted Answer

Some accounts have manually created resources that conflict with the stack set template's resources.. StackSets deploy a common template across accounts. If a resource defined in the template (e.g., a subnet with a specific CIDR) already exists in an account due to manual creation or prior configuration, the update fails with a 'resource already exists' error. Option A is incorrect because OU configuration affects initial deployment, not updates, and the error is about resource conflict, not OU coverage. Option C is incorrect because IAM permissions would cause an 'access denied' error, not a resource conflict. Option D is incorrect because drift detection does not prevent updates; it only reports differences.

Answer

The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

Answer

The network team does not have sufficient IAM permissions to update stacks in those accounts.

Answer

The stack set was previously drift-detected and the drift is preventing updates.