SAP-C02 Design Solutions for Organizational Complexity Practice Test 15 — 15 Questions

Question 1

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

Accepted Answer

Deploy the directory in a shared services VPC in the management account. Use AWS Transit Gateway to connect all VPCs and configure the directory's DNS as a forwarder via Amazon Route 53 Resolver.. Option A is correct because using AWS Transit Gateway with a shared services VPC allows centralized DNS resolution via VPC Peering or DNS forwarding. Option B (Route 53 Resolver endpoints) is also a good solution but is more complex and costly. Option C (Direct Connect) is not needed. Option D (VPN) is less scalable.

Answer

Create a VPN connection between each VPC and the on-premises AD, then use DNS forwarders.

Answer

Use Amazon Route 53 private hosted zones and associate them with all VPCs.

Answer

Deploy the directory in each VPC and use AWS Managed Microsoft AD multi-region replication.

Question 2

A company is implementing a new multi-account strategy using AWS Organizations. The central IT team wants to delegate management of certain AWS services to individual account administrators while maintaining centralized governance. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create IAM roles in each account that can be assumed from the central account with limited permissions.. Option A is correct because AWS CloudFormation StackSets allows central deployment of resources across accounts. Option D is correct because IAM roles with cross-account trust allow delegated administration. Option B is incorrect because root user access should be restricted, not granted. Option C is incorrect because SCPs can restrict actions but cannot delegate management. Option E is incorrect because sharing root credentials violates security best practices.

Answer

Create SCPs that allow all actions except those managed centrally.

Answer

Share the root user credentials of each account with the respective administrator.

Answer

Grant each account administrator full access to the management account.

Question 3

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

Accepted Answer

Create an AWS Glue table or use Athena's CREATE TABLE statement to define the schema of the Flow Logs.. Option B is correct because Athena requires a table defined over the data. Option C is correct because Flow Logs should be stored in a central S3 bucket. Option D is correct because Flow Logs are delivered to S3 in GZIP format, which Athena can query. Option A is incorrect because Kinesis Data Firehose is not needed; Flow Logs can go directly to S3. Option E is incorrect because the logs must be in the same region as the Athena queries.

Answer

Replicate the S3 bucket to a single AWS Region for consistency.

Answer

Configure a Kinesis Data Firehose delivery stream to convert Flow Logs to Parquet format.

Question 4

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

Accepted Answer

Apply an SCP to the production OU that denies all actions to non-approved IAM roles.. Option B is correct because SCPs can deny actions on production accounts. Option D is correct because IAM roles with limited permissions can restrict developer access. Option A is incorrect because AWS Config does not prevent actions. Option C is incorrect because CloudTrail is auditing, not enforcement. Option E is incorrect because tagging does not prevent deployment.

Answer

Enable AWS CloudTrail to monitor and alert on production changes.

Answer

Use resource tags to identify development and production resources and enforce policies via SCPs.

Answer

Use AWS Config rules to detect unauthorized deployments in production.

Question 5

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

Accepted Answer

Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.. Option C is correct because AWS CloudFormation StackSets with drift detection and automatic remediation can detect and correct any changes to the VPC stack across all accounts. SCPs can then deny changes to the VPC resources outside of StackSets, preventing unauthorized modifications. Option A is reactive and does not prevent drift. Option B requires custom development and is less integrated. Option D is not integrated with StackSets and requires manual steps.

Answer

Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.

Answer

Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.

Answer

Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.

Question 6

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

Accepted Answer

Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.. Option D is correct because using AWS Glue crawlers with partition indexes allows automatic discovery of new partitions as new accounts add logs. The crawler can be scheduled to run periodically, updating the table metadata. Option A requires manual partition management. Option B requires converting logs to a common format, which adds overhead. Option C requires manual DDL updates.

Answer

Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

Answer

Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

Answer

Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

Question 7

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

Accepted Answer

Use the management account to assume an IAM role in each member account that has permissions to reset the root user password and enable MFA. Then, rotate the root user password and enable MFA.. Option B is correct because AWS Organizations allows you to create an IAM role in each member account that can be assumed from the management account. The root user password can be reset and MFA can be enabled by assuming the role with appropriate permissions. Option A is incorrect because you cannot use AWS Organizations to manage root user credentials directly. Option C is incorrect because AWS Single Sign-On (now IAM Identity Center) does not manage root users. Option D is inefficient and insecure as it requires sharing root credentials.

Answer

Use AWS Organizations to create a new IAM user in each member account with full permissions, and disable the root user.

Answer

Capture the root user email addresses and passwords in a secure password manager and share them with the security team.

Answer

Use AWS Single Sign-On (SSO) to grant the security team access to the root user credentials for each account.

Question 8

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.. Option C is correct because Service Control Policies (SCPs) can be used to enforce that CloudTrail and Config are enabled and cannot be disabled by member accounts. Option A is wrong because CloudFormation StackSets require manual deployment to each account. Option B is wrong because AWS Config rules alone cannot enforce CloudTrail. Option D is wrong because IAM permissions boundaries do not enforce service enablement.

Answer

Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.

Answer

Use IAM permissions boundaries to restrict what users can do in each account.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Question 9

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

Accepted Answer

Use AWS Firewall Manager to centrally define and apply security group policies across accounts.. Option D is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and VPCs. Option A is wrong because manual scripting is error-prone. Option B is wrong because AWS Config does not enforce rules; it only detects drift. Option C is wrong because Network ACLs are stateless and not as granular as security groups.

Answer

Use AWS Config rules to detect non-compliant security groups and send alerts.

Answer

Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

Answer

Use network ACLs instead of security groups to enforce segmentation.

Question 10

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

Accepted Answer

Create separate AWS accounts for each environment using AWS Organizations.. Option A is correct because AWS Organizations with multiple accounts is the recommended approach for environment isolation. Option B is wrong because VPC separation is not enough within the same account. Option C is wrong because tags do not provide isolation. Option D is wrong because IAM alone does not isolate resources.

Answer

Use separate VPCs within the same account.

Answer

Use IAM policies to restrict access per environment.

Answer

Use resource tagging to separate environments.

Question 11

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

Accepted Answer

Use AWS Control Tower Account Factory Customization (AFC).. Option B is correct because Account Factory Customization (AFC) in Control Tower allows automatic deployment of custom templates when new accounts are provisioned. Option A is wrong because StackSets require manual invocation. Option C is wrong because Service Catalog does not automate deployment. Option D is wrong because Lifecycle hooks are not part of Control Tower.

Answer

Use AWS Service Catalog portfolio to share templates.

Answer

Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

Answer

Use AWS CloudFormation StackSets and manually trigger them for new accounts.

Question 12

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

Accepted Answer

Enable AWS Config aggregator and use advanced queries to search for trust policies.. Option D is correct because using AWS Config advanced queries across accounts with aggregation is scalable. Option A is wrong because manual review is not scalable. Option B is wrong because Trusted Advisor does not cover custom policies. Option C is wrong because IAM Access Analyzer identifies external access but does not provide a full audit of trust policies.

Answer

Use AWS Trusted Advisor to check for overly permissive roles.

Answer

Write a script using AWS SDK to list roles in each account and analyze trust policies.

Answer

Use IAM Access Analyzer to generate findings for each account.

Question 13

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

Accepted Answer

Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.. Option B is correct because AWS Cost Categories allow allocation based on rules, and AWS Budgets can notify when untagged resources are created. Option A is wrong because Cost Explorer alone cannot enforce tagging. Option C is wrong because SCPs cannot enforce tagging on all resources. Option D is wrong because Trusted Advisor does not enforce tagging.

Answer

Use AWS Trusted Advisor to check for untagged resources.

Answer

Use Service Control Policies to deny creation of untagged resources.

Answer

Use AWS Cost Explorer to filter by tags and manually identify untagged resources.

Question 14

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

Accepted Answer

Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.. Option A is correct because AWS Backup requires cross-account role assumption and specific backup permissions. Option B is wrong because KMS permissions are needed only if using custom keys. Option C is wrong because S3 permissions are not required for backup. Option D is wrong because Config permissions are not needed.

Answer

Create a customer managed key in the backup account and share it with member accounts.

Answer

Grant the backup account full S3 access to member account buckets.

Answer

Enable AWS Config in member accounts to track backup compliance.

Question 15

A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?

Accepted Answer

Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.. Option D is correct because SCPs can deny EC2 actions in non-approved regions across all accounts. Option A is wrong because IAM policies in each account require manual management. Option B is wrong because AWS Config only detects non-compliance. Option C is wrong because VPC endpoints do not restrict EC2 launch.

Answer

Use AWS Config rules to detect EC2 instances in non-approved regions and trigger automatic termination.

Answer

Create IAM policies in each account that deny EC2 actions outside approved regions.

Answer

Use VPC endpoints to restrict API calls to approved regions.