SAP-C02 Design Solutions for Organizational Complexity Practice Test 16 — 15 Questions

Question 1

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

Accepted Answer

Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.. Option A is correct because S3 bucket policies with condition keys for AWS Organizations allow secure cross-account access. Option B is wrong because presigned URLs expire and require management. Option C is wrong because IAM roles require users to switch roles. Option D is wrong because making the bucket public is insecure.

Answer

Make the bucket public with read-only access.

Answer

Generate presigned URLs for each account to access the bucket.

Answer

Create IAM roles in each account with permissions to assume a role in the central account.

Question 2

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.. Option A is correct because SCPs can deny CloudTrail:StopLogging and CloudTrail:DeleteTrail actions. Option D is correct because AWS Config rules can detect and remediate disabled trails. Option B is wrong because IAM permissions boundaries do not prevent root user actions. Option C is wrong because Trusted Advisor does not enforce. Option E is wrong because AWS Shield is for DDoS protection.

Answer

Use AWS Trusted Advisor to alert when CloudTrail is disabled.

Answer

Use AWS Shield Advanced to protect CloudTrail.

Answer

Use IAM permissions boundaries to restrict user permissions.

Question 3

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs API calls. Option C is correct because CloudWatch Logs can aggregate logs from multiple accounts into a central account. Option A is wrong because S3 is storage, not aggregation. Option D is wrong because Config records resource changes, not API calls. Option E is wrong because VPC Flow Logs capture network traffic.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon S3

Question 4

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Accepted Answer

Enable AWS Systems Manager Inventory in each account.. Option A is correct because AWS Systems Manager Inventory can collect instance metadata. Option C is correct because a cross-account role is needed for Systems Manager to access instances in other accounts. Option E is correct because enabling Systems Manager in each account is required. Option B is wrong because Config aggregator collects configuration data, not inventory metadata. Option D is wrong because CloudWatch only collects metrics.

Answer

Configure Amazon CloudWatch agent to send inventory data.

Answer

Set up an AWS Config aggregator in the management account.

Question 5

A financial services company uses AWS Organizations with a multi-account structure: a central security account, a shared services account, and multiple workload accounts. The security team needs to centrally manage and audit all changes to security groups across all accounts. They have implemented AWS Config with an aggregator in the security account. However, they notice that changes to security groups in workload accounts are not appearing in the aggregator. The workload accounts have AWS Config enabled and are recording security group changes. The security account has the necessary cross-account permissions. What is the most likely cause and solution?

Accepted Answer

The security account is not authorized in each workload account's Config settings. The security team must add the security account as an authorized aggregator in each workload account.. Option A is correct because AWS Config aggregator requires an authorized aggregator account that is set up in each source account. Without this authorization, the aggregator cannot collect data. Option B is wrong because Config is recording changes. Option C is wrong because CloudTrail is not needed for Config aggregation. Option D is wrong because SCPs do not block Config aggregation.

Answer

AWS CloudTrail is not enabled in workload accounts. The security team must enable CloudTrail.

Answer

Service Control Policies are blocking cross-account access. The security team must modify SCPs to allow Config aggregation.

Answer

AWS Config in workload accounts is not recording security group changes. The security team must enable recording for security groups.

Question 6

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

Accepted Answer

The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.. Option C is correct because SCPs apply to all principals in the account, including administrators. Option A is wrong because the development team has admin access. Option B is wrong because CloudFormation does not have a separate policy. Option D is wrong because IAM roles do not override SCPs.

Answer

The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.

Answer

CloudFormation service role is missing. They need to create a service role with appropriate permissions.

Answer

The production account's IAM roles are not trusted. They need to update the trust policy.

Question 7

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

Accepted Answer

Use IAM policies with conditions based on resource tags to restrict access within the single account.. Option D is correct because it provides logical separation using IAM policies and resource tags without the overhead of multiple accounts. Option A is wrong because multiple accounts increase costs due to minimum services per account. Option B is wrong because OUs do not provide IAM user management. Option C is wrong because SCPs are for account-level restrictions, not user-level.

Answer

Create an Organizational Unit for each business unit within the existing account.

Answer

Create a separate AWS account for each business unit and use consolidated billing to manage costs.

Answer

Use Service Control Policies to restrict each business unit's access to specific services.

Question 8

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

Accepted Answer

Create an SCP to deny PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that do not meet the requirements.. Option A is correct because SCPs can deny actions that do not meet encryption or public access requirements. Option D is correct because AWS Config rules can be used to detect and remediate non-compliant buckets. Option B is wrong because IAM permissions are per-account and not centrally enforced. Option C is wrong because tagging does not enforce security requirements. Option E is wrong because it does not enforce across all accounts; it only sets defaults for new buckets.

Answer

Use AWS Service Catalog to enforce S3 bucket encryption and public access settings.

Answer

Define a tag policy that requires encryption and public access tags on all S3 buckets.

Answer

Use IAM policies in the management account to restrict S3 permissions for all users.

Question 9

A company has a multi-account AWS environment with 50 accounts. They need to implement a centralized logging solution for VPC Flow Logs, CloudTrail, and AWS Config logs. The logs must be stored in a central S3 bucket and encrypted with a customer-managed KMS key. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create an S3 bucket policy that grants permissions to the CloudTrail and AWS Config service principals from all accounts to write logs.. Option A is correct because the central S3 bucket must allow log delivery from all accounts via bucket policy. Option B is correct because CloudTrail trails can be configured to deliver to a central bucket across accounts. Option D is correct because KMS key policy must grant permissions to the log delivery services across accounts. Option C is wrong because VPC Flow Logs cannot be directly aggregated to a central account without third-party tools or cross-account delivery. Option E is wrong because AWS Config data is per-account; aggregation is done via Aggregator, not direct log delivery.

Answer

Use AWS Config aggregator to collect configuration data from all accounts into a central account.

Answer

Enable VPC Flow Logs in each account and deliver them to a central CloudWatch Logs group.

Question 10

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Accepted Answer

Create an SCP that denies all actions in non-approved regions.. Option A is correct because SCPs can deny actions in non-approved regions. Option C is correct because SCPs can deny creation of resources that do not have the required tag. Option D is correct because AWS Config rules can detect untagged resources and trigger remediation. Option B is wrong because IAM policies are per-account and not centrally managed; they can be used but SCPs are more centralized. Option E is wrong because Tag Policies enforce tagging on resource creation via SCPs, but they do not remediate existing resources.

Answer

Use IAM policies in each account to deny actions in non-approved regions.

Answer

Define a tag policy using AWS Organizations to enforce cost center tags.

Question 11

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

Accepted Answer

Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.. Option C is correct because AWS Config rules can be deployed across all accounts via AWS Organizations, and the custom remediation action can disable access keys. Option A is wrong because IAM Access Analyzer does not manage MFA. Option B is wrong because SCPs cannot enforce MFA on existing users; they can deny access if MFA is not present, but they cannot disable keys. Option D is wrong because AWS IAM Identity Center is for workforce identity, not for managing existing IAM users.

Answer

Create an SCP that denies all API calls if the user does not have an MFA device.

Answer

Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.

Answer

Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.

Question 12

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

Accepted Answer

The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.. Option A is correct because the KMS key policy must grant the VPC Flow Logs service principal permission to use the key for encryption. Even if the IAM role has permissions, the key policy is separate and must be explicitly set. Option B is wrong because bucket policies are evaluated after key policy; bucket policy is not the issue here. Option C is wrong because VPC Flow Logs do not use CloudWatch Logs for S3 delivery directly. Option D is wrong because bucket policies are not the primary issue; the key policy is missing.

Answer

The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

Answer

The S3 bucket policy denies access to the workload accounts.

Answer

The S3 bucket has a bucket policy that requires encryption in transit.

Question 13

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

Accepted Answer

Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.. Option B is correct because a trail in the management account can log management events for all accounts, but to log data events for member accounts, the trail must be created in each member account or use a trail in the management account with the 'Include global services' option not applicable. Data events are per-account unless using advanced event selectors with cross-account support, but standard trails require account-specific settings. Option A is wrong because CloudTrail does not require S3 bucket policies for logging. Option C is wrong because there is no such limitation. Option D is wrong because encryption does not affect logging.

Answer

The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.

Answer

The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.

Answer

The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.

Question 14

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.. Option D is correct because AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts. Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Answer

Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

Answer

Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

Answer

Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

Question 15

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

Accepted Answer

Each member account must individually configure the S3 bucket as a publishing destination for its own findings.. Option D is correct because for GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place. Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Answer

The GuardDuty detector in the management account is not configured to publish findings to S3.

Answer

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Answer

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.