SAP-C02 Design Solutions for Organizational Complexity Practice Test 14 — 15 Questions

Question 1

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Option C is correct because SCPs can restrict the Region where resources can be created, and AWS Config can detect noncompliant resources. Option A is wrong because VPC endpoints do not restrict resource creation. Option B is wrong because AWS WAF is for web traffic. Option D is wrong because resource-based policies alone cannot prevent resource creation in other regions.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 2

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

Accepted Answer

AWS IAM Identity Center (AWS SSO).. Option C is correct because AWS IAM Identity Center (successor to AWS SSO) allows centralized management of user access across multiple accounts. Option A is wrong because IAM is per account. Option B is wrong because Cognito is for customer-facing identities. Option D is wrong because Directory Service is not for managing IAM identities.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

AWS Identity and Access Management (IAM) in the management account.

Answer

Amazon Cognito user pools.

Question 3

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. Options A and B are correct. SCP can deny creation of unencrypted buckets, and Config can detect noncompliant buckets. Option C is wrong because bucket policies can be bypassed by bucket owners. Option D is wrong because IAM policies are per-account and may not cover all principals. Option E is wrong because S3 Block Public Access does not address encryption.

Answer

Attach a bucket policy to each bucket that denies PutObject without encryption.

Answer

Create an IAM policy that denies s3:PutObject unless encryption is specified.

Answer

Enable S3 Block Public Access at the organization level.

Question 4

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Accepted Answer

Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.. Options A, B, and C are correct. SCPs enforce CIDR restrictions, CloudFormation StackSets deploy standard resources, and Config rules detect noncompliance. Option D is wrong because IAM roles do not enforce network config. Option E is wrong because it is reactive.

Answer

Create an IAM role in each account with permissions to manage VPCs.

Answer

Set up AWS Lambda functions to terminate noncompliant VPCs daily.

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.. Options A and C are correct. CloudTrail logs root user activities, and CloudWatch Events can trigger alerts. Option B is wrong because SCPs cannot restrict root user actions. Option D is wrong because IAM roles are for human users, not root. Option E is wrong because Config does not monitor root activities specifically.

Answer

Use AWS Config rules to detect root user usage.

Answer

Create an IAM role for root user with limited permissions.

Answer

Attach a service control policy (SCP) to all accounts to deny root user actions.

Question 6

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

Accepted Answer

Some accounts have manually created resources that conflict with the stack set template's resources.. Option C is correct because StackSets use a single template, and if an account already has a resource with the same logical ID (e.g., due to a previous manual creation), the update fails. Option A is wrong because stack set updates can be performed with proper permissions. Option B is wrong because StackSets can manage resources across OUs, but the issue is resource conflict. Option D is wrong because drift does not prevent updates; it would be detected separately.

Answer

The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

Answer

The network team does not have sufficient IAM permissions to update stacks in those accounts.

Answer

The stack set was previously drift-detected and the drift is preventing updates.

Question 7

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

Accepted Answer

The SCP denies all actions except those from allowed services, but the console makes calls that are not from an allowed service.. Option D is correct because SCPs that deny all actions unless the request comes from allowed services would block the initial API call to EC2 because the console makes calls to multiple services. Option A is wrong because the SCP already allows EC2. Option B is wrong because the SCP is attached to the root OU, so it applies to all accounts. Option C is wrong because the issue is not about resource-based policies.

Answer

The SCP does not include 'ec2:RunInstances' in the list of allowed actions.

Answer

The SCP is attached only to the root OU and not to the specific account OUs.

Answer

The IAM roles used by the DevOps team do not have a trust policy that allows the EC2 service.

Question 8

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

Accepted Answer

Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.. Option C is correct because SCPs can centrally deny actions across all accounts in an organization, enforcing encryption and blocking anonymous access without requiring changes to each account. Option A (IAM roles) requires per-account setup and cannot prevent root user actions. Option B (bucket policies) must be applied per bucket. Option D (AWS Config rules) can detect violations but not prevent them proactively.

Answer

Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.

Answer

Use S3 bucket policies with Deny statements for anonymous access and missing encryption.

Answer

Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.

Question 9

A company uses AWS Organizations with hundreds of accounts. The central IT team wants to manage IP address ranges for VPCs across all accounts using a custom AWS Resource Access Manager (RAM) resource share. They have created a resource share containing the IP address CIDR blocks (as managed prefix lists) and shared it with the organization. However, some accounts cannot see the shared prefix lists. What is the MOST likely cause?

Accepted Answer

The organization's sharing feature for Amazon VPC is not enabled in the management account.. Option D is correct because RAM sharing with an organization requires that all accounts have the sharing feature enabled via the Organization's trusted access. Option A is incorrect because RAM supports prefix lists. Option B is incorrect because resource shares can include multiple resources. Option C is incorrect because RAM sharing with the entire organization does not require individual invites.

Answer

Managed prefix lists are not supported by AWS RAM.

Answer

The accounts need to accept the resource share invitation manually.

Answer

The resource share can only include one type of resource at a time.

Question 10

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

Accepted Answer

Configure VPC Flow Logs to deliver to an S3 bucket in each account, then enable S3 Cross-Region Replication to the central bucket in the logging account.. Option B is correct because it uses S3 Cross-Region Replication to aggregate logs without additional compute, and is scalable. Option A (Lambda) adds cost and complexity. Option C (Amazon Kinesis Data Firehose) is more expensive for log aggregation than replication. Option D (S3 batch operations) is not designed for real-time log delivery.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create a Lambda function in each account that copies log files to the central bucket.

Answer

Use S3 Batch Operations to copy logs from each account to the central bucket daily.

Question 11

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

Accepted Answer

No, because the Deny statement blocks all HTTP requests regardless of encryption.. Option C is correct. The first statement denies all S3 actions if SecureTransport is false (HTTP), which applies regardless of encryption. The second statement allows PutObject only with SSE-S3, but it is conditional on HTTPS? No, the condition is only on encryption. However, the Deny overrides Allow. Since the request is HTTP, the Deny matches and the request is denied. Option A is wrong because the Deny applies to HTTP. Option B is wrong because the Deny overrides Allow. Option D is wrong because SSE-S3 does not satisfy the SecureTransport condition.

Answer

Yes, because the Deny statement only applies to non-encrypted requests.

Answer

Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.

Answer

No, because the Allow statement requires HTTPS transport.

Question 12

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. Option B is correct because AWS Control Tower provides Account Factory and guardrails to automatically apply baselines to new accounts. Option A (Lambda + CloudFormation StackSets) requires custom code and is less integrated. Option C (SCPs) can only deny actions, not create resources. Option D (AWS Config conformance packs) can deploy rules but cannot create VPCs.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 13

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

Accepted Answer

A policy that allows iam:* and denies organizations:CreateAccount, organizations:CreateOrganizationalUnit, organizations:UpdateOrganizationalUnit, and organizations:DeleteOrganizationalUnit.. Option D is correct because it explicitly denies the organizational-level actions that could modify the OU structure or create accounts, while allowing other IAM actions. Option A allows full administration, violating the restriction. Option B denies all IAM actions, preventing any management. Option C allows full organization management, which is too permissive.

Answer

A policy that denies all IAM and organization actions except for viewing.

Answer

A policy that allows all IAM actions and denies organizations:CreateAccount and organizations:UpdateOrganizationalUnit.

Answer

A policy that allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization.

Question 14

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

Accepted Answer

Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.. Option B is correct because CloudWatch Logs can stream to a cross-account Kinesis stream in the logging account, which can then be processed and stored in S3. Option A is not serverless; Option C uses S3 replication which is not near real-time; Option D uses Lambda which is more complex and less resilient.

Answer

S3 buckets in each account with cross-region replication enabled to a central bucket.

Answer

Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.

Answer

Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.

Question 15

A company uses AWS Organizations with multiple OUs. The security team needs to ensure that no EC2 instances are launched without an approved Amazon Machine Image (AMI) ID from a central list. The list changes frequently. What is the MOST scalable way to enforce this?

Accepted Answer

Use an SCP that denies ec2:RunInstances unless the AMI has a specific tag (e.g., "Approved":"true"). Central team tags approved AMIs.. Option C is correct because SCPs can conditionally deny actions based on tags, and you can use a tag on approved AMIs. Option A (Config rule + Lambda) can only remediate after launch. Option B (IAM condition) requires updating policies per account. Option D (CloudFormation) is not real-time and cannot prevent manual launches.

Answer

Use AWS CloudFormation StackSets to deploy AMI approval rules via EC2 launch templates.

Answer

Use AWS Config with a custom rule that triggers a Lambda function to terminate non-compliant instances.

Answer

Create an IAM policy condition that only allows ec2:RunInstances if the AMI ID matches a list in the condition.