SAP-C02 Design Solutions for Organizational Complexity Practice Test 15 — 15 Questions

Question 1

A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Service control policies (SCPs) are the only preventive control that can centrally deny actions across all accounts in an AWS Organization. SCPs affect all users and roles, including the root user, and can block the ability to stop CloudTrail logging or delete trails. Option A (AWS Config rules) is detective and can trigger remediation, but it is not preventive; remediation can fail or be bypassed. Option C (IAM policy) only applies within an account and does not prevent actions by the root user or external roles. Option D (resource-based policy) cannot be applied to CloudTrail trails to deny actions; CloudTrail supports resource-based policies for delivery notifications (SNS) but not to control trail management actions.

Answer

Use AWS Config rules to detect and remediate any changes to CloudTrail configurations.

Answer

Create an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all IAM users.

Answer

Apply a resource-based policy to the CloudTrail trail that denies these actions.

Question 2

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

Accepted Answer

Use service control policies with aws:SourceIp and aws:SourceVpc conditions.. Service control policies (SCPs) in AWS Organizations can enforce a data perimeter by restricting access based on network origin using the `aws:SourceIp` and `aws:SourceVpc` condition keys. This approach works across all accounts in the organization, ensuring that only requests from approved networks (e.g., specific IP ranges or VPCs) are allowed, regardless of individual account configurations.

Answer

Use S3 bucket policies with aws:SourceIp condition.

Answer

Use AWS Config rules to detect and alert on non-compliant access.

Answer

Use network ACLs in each VPC.

Question 3

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.. Option C is correct because an SCP attached at the organization, OU, or account level sets a permissions guardrail that applies to all IAM principals in member accounts, and the condition denying console actions unless aws:MultiFactorAuthPresent is true enforces MFA across the whole organization centrally. Option E is correct because an IAM policy (identity-based or permissions boundary) with the same aws:MultiFactorAuthPresent condition denies console access for users who have not authenticated with MFA, providing the in-account enforcement that complements the SCP. Together, the SCP prevents circumvention by account administrators while the IAM policy ensures the deny is evaluated for the actual IAM users. Option A is not correct because AWS Config rules only detect and alert on noncompliance; they do not enforce or block access. Option B is not correct because CloudTrail is an auditing/logging service and cannot enforce MFA. Option D is not correct because AWS SSO (IAM Identity Center) manages federated access and does not enforce MFA on existing IAM users' console sign-in.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Enable AWS CloudTrail to log console access without MFA.

Answer

Use AWS Single Sign-On (SSO) with MFA enabled for all users.

Question 4

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

Accepted Answer

Denies launching instances that are not t3.micro or t3.small for IAM users and roles, but not root.. The SCP uses a Deny effect with a condition that denies any EC2:RunInstances action unless the instance type is t3.micro or t3.small. However, SCPs do not affect the root user (the management account's root user) because SCPs cannot restrict the root user in the management account. Therefore, the policy denies launching non-compliant instance types for IAM users and roles, but not for the root user.

Answer

Allows only t3.micro and t3.small instances to be launched.

Answer

Has no effect because SCPs cannot deny actions.

Answer

Denies launching any instance except t3.micro and t3.small for all users including root.

Question 5

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

Accepted Answer

No, because the source identity does not match.. The assumption fails because the trust policy on AuditRole includes a `sts:SourceIdentity` condition that requires the source identity to match a specific value (e.g., 'auditor'), but the session is launched with source identity 'admin'. Since the condition is not satisfied, AWS STS denies the AssumeRole API call, even though the principal (the Admin role in account 222222222222) is allowed by the `Principal` element. The `sts:SourceIdentity` condition key is evaluated at request time and must match exactly for the policy to grant access.

Answer

Yes, because the role in account 222222222222 is allowed by the principal.

Answer

No, because cross-account role assumption is not allowed.

Answer

Yes, because the source identity condition is optional.

Question 6

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

Accepted Answer

Use attribute-based access control (ABAC) with IAM Identity Center and session tags from Active Directory.. It uses attribute-based access control (ABAC) with IAM Identity Center, which allows permissions to be dynamically granted based on user attributes (e.g., job function) passed as session tags from Active Directory. This approach scales seamlessly as users and accounts grow, since policies reference tags rather than individual users or groups, and it centralizes identity management without requiring per-account role updates.

Answer

Create a permission set in IAM Identity Center for each job function and assign to appropriate groups.

Answer

Use AWS Organizations to attach SCPs that grant permissions based on user tags.

Answer

Use IAM roles directly in each account and manage trust policies centrally.

Question 7

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

Accepted Answer

Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.

Answer

Use an SCP to require that CloudTrail is enabled.

Answer

Use IAM policies in each account to deny the same actions.

Answer

Use AWS Config rules to detect and remediate changes.

Question 8

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 9

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

Accepted Answer

Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.. AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Answer

Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.

Answer

Use AWS Cost Explorer to filter by resource tags after they are manually applied.

Question 10

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

Accepted Answer

Deny effect with ec2:* and rds:* as the actions.. AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Answer

Deny effect with "*" as the action.

Answer

Deny effect with NotAction set to ec2:* and rds:*.

Answer

Allow effect with ec2:* and rds:* as the actions.

Question 11

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Accepted Answer

Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.. CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Answer

Use a VPC endpoint and route logs through a central VPC.

Answer

Attach an SCP to allow CloudTrail to write to the central bucket.

Answer

Create an IAM role in each member account and allow the central account to assume it.

Question 12

A company has a multi-account AWS environment. They want to ensure that any new account created in the organization automatically gets a specific set of IAM roles and AWS Config rules deployed. Which solution requires the least manual effort?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to the organization.. AWS CloudFormation StackSets with automatic deployment to the organization is the correct solution because it allows you to define a set of AWS resources (IAM roles, Config rules) as a CloudFormation template and automatically deploy it to every account in the organization, including newly created accounts, without any manual intervention. StackSets can be configured to deploy to all accounts in the organization or specific OUs, and they automatically handle the deployment to new accounts as they join the organization.

Answer

Use AWS Organizations and attach a tag policy that requires the roles and rules.

Answer

Attach an SCP to the root OU that creates the roles and rules.

Answer

Use AWS Lambda to periodically scan for new accounts and deploy resources.

Question 13

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.. AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Answer

Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

Answer

Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

Answer

Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

Question 14

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

Accepted Answer

Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.. Option B is correct because an AWS Organizations Service Control Policy (SCP) attached at the root or OU level applies to every account in the organization and can use a Deny statement with the condition aws:MultiFactorAuthPresent: false to block all actions (including console access) for principals that have not authenticated with MFA, giving centralized enforcement across all accounts. Option E is correct because attaching an IAM policy with a Deny for console-related actions (e.g., denying * when aws:MultiFactorAuthPresent is false) to all users ensures that even without an SCP, individual IAM principals cannot perform actions without MFA, and this policy can be applied consistently to every user in each account. Option A is not correct because CloudTrail is a logging and auditing service that can detect and alert on non-MFA logins after the fact, but it does not enforce or prevent access. Option C is not correct because assigning a virtual MFA device to each user only enables MFA; it does not require users to actually use it for console sign-in. Option D is not correct because creating an IAM group for users without MFA and denying console access is not a scalable or reliable enforcement mechanism, since group membership must be manually managed and does not automatically reflect MFA status.

Answer

Use AWS CloudTrail to detect console logins without MFA and send alerts.

Answer

Require each IAM user to have a virtual MFA device assigned.

Answer

Create an IAM group for users without MFA and deny them console access.

Question 15

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Accepted Answer

Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.. Option B is correct because IAM Identity Center can use AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) as its identity source, and when the company's AD is in AWS or connected via trust, this lets IAM Identity Center synchronize users and groups from Active Directory for SSO across accounts. Option D is correct because after users and groups are available, you grant account access by creating permission sets in IAM Identity Center and assigning those permission sets to the synchronized AD groups, which is the standard way to provide role-based SSO access to multiple AWS accounts. Option A is not correct because IAM Identity Center does not require or recommend manually importing AD users; it should be configured with a supported identity source such as AWS Managed Microsoft AD, AD Connector, or an external IdP. Option C is not correct as stated because AD Connector is a directory gateway for directing directory-aware AWS workloads to on-premises AD, not the mechanism for IAM Identity Center to synchronize AD users and groups for SSO. Option E is not correct because CloudTrail logging sign-in events is an auditing/monitoring activity and does not set up identity synchronization or SSO access.

Answer

Create an IAM Identity Center identity store and manually import users from Active Directory.

Answer

Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.

Answer

Configure AWS CloudTrail to log all sign-in events.