SAP-C02 Design Solutions for Organizational Complexity Practice Test 15 — 15 Questions

Question 1

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP denies all actions except those from allowed services, but the console makes calls that are not from an allowed service.. SCPs that deny all actions unless the request comes from allowed services would block the initial API call to EC2 because the console makes calls to multiple services. Option A is wrong because the SCP already allows EC2. Option B is wrong because the SCP is attached to the root OU, so it applies to all accounts. Option C is wrong because the issue is not about resource-based policies.

Answer

The SCP does not include 'ec2:RunInstances' in the list of allowed actions.

Answer

The SCP is attached only to the root OU and not to the specific account OUs.

Answer

The IAM roles used by the DevOps team do not have a trust policy that allows the EC2 service.

Question 2

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

Accepted Answer

Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.. AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all accounts in the organization without requiring per-account configuration. By creating SCPs that deny `s3:PutBucketPolicy` actions with an anonymous effect (using a condition key like `aws:SourceAccount` or inspecting the policy content) and deny `s3:PutObject` without the `x-amz-server-side-encryption-aws:kms` header, the security team ensures that no bucket can be made publicly accessible and no object can be uploaded without KMS encryption. This approach is the most efficient because it applies globally and proactively prevents non-compliant actions rather than detecting them after the fact.

Answer

Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.

Answer

Use S3 bucket policies with Deny statements for anonymous access and missing encryption.

Answer

Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.

Question 3

A company uses AWS Organizations with hundreds of accounts. The central IT team wants to manage IP address ranges for VPCs across all accounts using a custom AWS Resource Access Manager (RAM) resource share. They have created a resource share containing the IP address CIDR blocks (as managed prefix lists) and shared it with the organization. However, some accounts cannot see the shared prefix lists. What is the MOST likely cause?

Accepted Answer

The organization's sharing feature for Amazon VPC is not enabled in the management account.. AWS Organizations requires the 'Enable sharing with AWS Organizations' feature to be explicitly enabled in the management account for RAM to share resources with all accounts in the organization. Without this setting, resource shares are limited to individual accounts, and prefix lists shared via RAM will not be visible to member accounts.

Answer

Managed prefix lists are not supported by AWS RAM.

Answer

The accounts need to accept the resource share invitation manually.

Answer

The resource share can only include one type of resource at a time.

Question 4

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

Accepted Answer

Configure VPC Flow Logs to deliver to an S3 bucket in each account, then enable S3 Cross-Region Replication to the central bucket in the logging account.. VPC Flow Logs can be delivered directly to an S3 bucket in each account, and S3 Cross-Region Replication (CRR) can then automatically and asynchronously replicate the logs to a centralized bucket in the logging account. This approach is highly scalable (CRR handles replication without any custom code or infrastructure) and cost-effective (no additional compute or streaming services are needed; you only pay for S3 storage and replication costs).

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

Answer

Create a Lambda function in each account that copies log files to the central bucket.

Answer

Use S3 Batch Operations to copy logs from each account to the central bucket daily.

Question 5

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

Accepted Answer

No, because the Deny statement blocks all HTTP requests regardless of encryption.. The Deny statement in the policy explicitly blocks all HTTP requests (using `aws:SecureTransport`: false) regardless of whether the request uses SSE-S3 encryption. Since the user is uploading via an unencrypted HTTP connection, the Deny statement matches and overrides any Allow statement, causing the upload to fail. AWS IAM policy evaluation is explicit deny by default, so the Deny takes precedence.

Answer

Yes, because the Deny statement only applies to non-encrypted requests.

Answer

Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.

Answer

No, because the Allow statement requires HTTPS transport.

Question 6

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 7

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

Accepted Answer

A policy that allows iam:* and denies organizations:CreateAccount, organizations:CreateOrganizationalUnit, organizations:UpdateOrganizationalUnit, and organizations:DeleteOrganizationalUnit.. It grants the OU administrators full IAM permissions (iam:*) to manage roles and policies within their own OUs, while explicitly denying the specific Organizations API actions that could alter the OU structure (CreateOrganizationalUnit, UpdateOrganizationalUnit, DeleteOrganizationalUnit) or create new accounts (CreateAccount). This policy ensures administrators can perform their required tasks without being able to modify the organizational hierarchy or provision new accounts, aligning with the principle of least privilege.

Answer

A policy that denies all IAM and organization actions except for viewing.

Answer

A policy that allows all IAM actions and denies organizations:CreateAccount and organizations:UpdateOrganizationalUnit.

Answer

A policy that allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization.

Question 8

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

Accepted Answer

Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.. It uses CloudWatch Logs subscription filters to stream log data in near real-time to a Kinesis Data Stream in the central logging account, which then feeds into Kinesis Data Firehose for durable delivery to S3. This architecture is resilient to Regional failures because Kinesis Data Streams can be configured with cross-region replication or multi-region failover, and Firehose can buffer and retry writes to S3 across availability zones. It provides near real-time delivery (typically within 60 seconds) and centralizes logs without relying on per-account S3 replication or Lambda polling.

Answer

S3 buckets in each account with cross-region replication enabled to a central bucket.

Answer

Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.

Answer

Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.

Question 9

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

Accepted Answer

Deploy the directory in a shared services VPC in the management account. Use AWS Transit Gateway to connect all VPCs and configure the directory's DNS as a forwarder via Amazon Route 53 Resolver.. It centralizes the AWS Managed Microsoft AD in a shared services VPC, which is the most scalable and secure approach for cross-account and cross-VPC authentication and DNS resolution. AWS Transit Gateway provides a scalable hub-and-spoke network connectivity model, while Amazon Route 53 Resolver outbound endpoints forward DNS queries from all connected VPCs to the directory's DNS servers, ensuring consistent name resolution without exposing the directory to the internet or requiring per-VPC deployments.

Answer

Create a VPN connection between each VPC and the on-premises AD, then use DNS forwarders.

Answer

Use Amazon Route 53 private hosted zones and associate them with all VPCs.

Answer

Deploy the directory in each VPC and use AWS Managed Microsoft AD multi-region replication.

Question 10

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

Accepted Answer

Create an AWS Glue table or use Athena's CREATE TABLE statement to define the schema of the Flow Logs.. Athena requires a schema definition to query data in S3. You can either create an AWS Glue table (which is a managed schema catalog) or use Athena's CREATE TABLE statement to define the schema for VPC Flow Logs, including fields like version, account-id, interface-id, srcaddr, dstaddr, etc. Without this schema, Athena cannot parse the raw flow log data.

Answer

Replicate the S3 bucket to a single AWS Region for consistency.

Answer

Configure a Kinesis Data Firehose delivery stream to convert Flow Logs to Parquet format.

Question 11

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

Accepted Answer

Apply an SCP to the production OU that denies all actions to non-approved IAM roles.. An SCP attached to the production OU can explicitly deny all actions to any IAM role that is not on an approved list, effectively preventing developers from deploying resources in production. This leverages AWS Organizations to enforce a preventive control at the account level, which cannot be overridden by IAM policies within the account.

Answer

Enable AWS CloudTrail to monitor and alert on production changes.

Answer

Use resource tags to identify development and production resources and enforce policies via SCPs.

Answer

Use AWS Config rules to detect unauthorized deployments in production.

Question 12

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

Accepted Answer

Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.. The most efficient and secure solution because it uses StackSets drift detection with automatic remediation to continuously detect and correct any deviations from the intended VPC configuration across all accounts. Additionally, applying an SCP that denies VPC-related actions (e.g., ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute) unless performed by the StackSet's service role prevents unauthorized changes at the organization level. Option A is reactive and does not prevent drift; Option B requires manual provisioning and does not enforce consistent configuration automatically; Option C requires custom coding (Lambda function) and is less integrated than StackSets' built-in remediation.

Answer

Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.

Answer

Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.

Answer

Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.

Question 13

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

Accepted Answer

Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.. Using AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type allows automatic discovery of new partitions as new accounts are added. The crawler can be scheduled to run periodically, updating the table metadata without manual intervention. Partition indexing improves query performance by reducing the amount of data scanned. Option A is incorrect because updating a view requires manual DDL changes each time a new account is added. Option C is incorrect because manually managing partitions and using MSCK REPAIR TABLE still requires manual effort to add new partitions. Option D is incorrect because converting logs to Parquet adds overhead and does not solve the need for automatic partition discovery across accounts.

Answer

Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

Answer

Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

Answer

Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

Question 14

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

Accepted Answer

Use the management account to assume an IAM role in each member account that has permissions to reset the root user password and enable MFA. Then, rotate the root user password and enable MFA.. It leverages AWS Organizations to create an IAM role in each member account with permissions to reset the root user password and enable MFA. The security team can assume this role from the management account, allowing them to securely manage root user credentials without sharing them. Option A is incorrect because the root user cannot be disabled, and creating an IAM user does not provide access to the root user. Option B is insecure as it involves sharing root credentials. Option D is incorrect because AWS SSO (now IAM Identity Center) does not manage root user credentials.

Answer

Use AWS Organizations to create a new IAM user in each member account with full permissions, and disable the root user.

Answer

Capture the root user email addresses and passwords in a secure password manager and share them with the security team.

Answer

Use AWS Single Sign-On (SSO) to grant the security team access to the root user credentials for each account.

Question 15

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.. Service Control Policies (SCPs) can be used to enforce that CloudTrail and AWS Config are enabled and cannot be disabled by member accounts. Option B is wrong because CloudFormation StackSets require manual deployment to each account and do not prevent disabling. Option C is wrong because IAM permissions boundaries do not enforce service enablement. Option D is wrong because AWS Config conformance packs deploy rules but cannot enforce CloudTrail enablement.

Answer

Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.

Answer

Use IAM permissions boundaries to restrict what users can do in each account.

Answer

Use AWS Config conformance packs to deploy rules across accounts.