SAP-C02 Design Solutions for Organizational Complexity Practice Test 16 — 15 Questions

Question 1

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Firewall Manager to centrally define and apply security group policies across accounts.. AWS Firewall Manager is the correct choice because it provides a centralized, policy-based approach to define and apply security group rules across multiple accounts and VPCs in an AWS Organization. It integrates with AWS Transit Gateway to enforce consistent network segmentation in a hub-and-spoke model, minimizing operational overhead by automating rule enforcement and compliance without custom scripting or manual periodic checks.

Answer

Use AWS Config rules to detect non-compliant security groups and send alerts.

Answer

Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

Answer

Use network ACLs instead of security groups to enforce segmentation.

Question 2

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

Accepted Answer

Create separate AWS accounts for each environment using AWS Organizations.. Creating separate AWS accounts via AWS Organizations (Option C) is the recommended best practice for isolating environments and enhancing security. This approach provides strong logical and billing separation, aligns with the AWS Well-Architected Framework's security pillar, and minimizes blast radius. Option A (separate VPCs) does not fully isolate because all resources still reside in the same account, sharing service quotas and increasing risk. Option B (IAM policies) alone cannot prevent cross-environment access at the network or resource level. Option D (resource tagging) only aids in organization, not isolation.

Answer

Use separate VPCs within the same account.

Answer

Use IAM policies to restrict access per environment.

Answer

Use resource tagging to separate environments.

Question 3

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

Accepted Answer

Use AWS Control Tower Account Factory Customization (AFC).. AWS Control Tower Account Factory Customization (AFC) is designed to automatically apply custom CloudFormation templates to new accounts provisioned through Account Factory within a specified OU. It uses lifecycle events to trigger the deployment, ensuring that every new account in the OU receives the baseline configuration without manual intervention.

Answer

Use AWS Service Catalog portfolio to share templates.

Answer

Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

Answer

Use AWS CloudFormation StackSets and manually trigger them for new accounts.

Question 4

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

Accepted Answer

Enable AWS Config aggregator and use advanced queries to search for trust policies.. AWS Config aggregator with advanced queries allows you to query the resource configuration of IAM roles across all accounts in AWS Organizations from a single management account. This approach is serverless, scalable, and provides a centralized view without needing to script cross-account access or manage multiple findings. The query can filter on the 'assumeRolePolicyDocument' field to detect trust policies that allow external principals (e.g., 'Effect: Allow' with 'AWS': '*' or a non-account ARN).

Answer

Use AWS Trusted Advisor to check for overly permissive roles.

Answer

Write a script using AWS SDK to list roles in each account and analyze trust policies.

Answer

Use IAM Access Analyzer to generate findings for each account.

Question 5

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

Accepted Answer

Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.. AWS Cost Categories allow allocating costs based on rules, and AWS Budgets can alert when untagged resources exist. Option A is wrong because AWS Trusted Advisor can identify untagged resources but cannot enforce cost allocation. Option B is wrong because Service Control Policies can deny creation of untagged resources but do not address cost allocation for existing untagged resources. Option D is wrong because AWS Cost Explorer can filter by tags but requires manual identification and does not automate cost allocation for untagged resources.

Answer

Use AWS Trusted Advisor to check for untagged resources.

Answer

Use Service Control Policies to deny creation of untagged resources.

Answer

Use AWS Cost Explorer to filter by tags and manually identify untagged resources.

Question 6

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

Accepted Answer

Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.. AWS Backup requires cross-account IAM roles to delegate backup and restore permissions. The central backup account assumes an IAM role in each member account that has a trust policy allowing the backup account's IAM entity to perform backup and restore actions. This is the minimal set of permissions needed to manage backups across accounts without granting broader access.

Answer

Create a customer managed key in the backup account and share it with member accounts.

Answer

Grant the backup account full S3 access to member account buckets.

Answer

Enable AWS Config in member accounts to track backup compliance.

Question 7

A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?

Accepted Answer

Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that denies EC2:RunInstances in non-approved regions, you enforce a guardrail that applies to all IAM users and roles in the member accounts, regardless of their individual IAM policies. This is the most effective approach because SCPs are evaluated before IAM policies and cannot be overridden by account administrators.

Answer

Use AWS Config rules to detect EC2 instances in non-approved regions and trigger automatic termination.

Answer

Create IAM policies in each account that deny EC2 actions outside approved regions.

Answer

Use VPC endpoints to restrict API calls to approved regions.

Question 8

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

Accepted Answer

Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.. Using the `aws:PrincipalOrgID` condition key in an S3 bucket policy allows you to grant access to all principals (users, roles) within your AWS Organization without needing to list individual account IDs. This approach is both secure (no public access) and scalable (automatically includes new accounts added to the organization).

Answer

Make the bucket public with read-only access.

Answer

Generate presigned URLs for each account to access the bucket.

Answer

Create IAM roles in each account with permissions to assume a role in the central account.

Question 9

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.. A Service Control Policy (SCP) is a centralized policy in AWS Organizations that can deny specific actions across all accounts in the organization. By attaching an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `cloudtrail:UpdateTrail` actions, you can prevent any user or role, including the root user, from disabling or deleting CloudTrail, ensuring compliance with the multi-account strategy.

Answer

Use AWS Trusted Advisor to alert when CloudTrail is disabled.

Answer

Use AWS Shield Advanced to protect CloudTrail.

Answer

Use IAM permissions boundaries to restrict user permissions.

Question 10

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made within an AWS account, including the identity, source IP, and timestamp. Centralizing logging across multiple accounts requires sending these CloudTrail logs to a central Amazon S3 bucket (often with cross-account permissions) and then using Amazon CloudWatch Logs to monitor, alert, or analyze the logs in real time. Together, CloudTrail captures the API activity, and CloudWatch Logs provides a unified log management and monitoring layer.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon S3

Question 11

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Accepted Answer

Enable AWS Systems Manager Inventory in each account.. AWS Systems Manager Inventory provides a native, agentless mechanism to collect and query EC2 instance metadata, software inventory, and configuration across accounts. Enabling Systems Manager in each account is a prerequisite for using Inventory, as it relies on the SSM Agent and the Systems Manager service to gather and store inventory data in a centralized manner.

Answer

Configure Amazon CloudWatch agent to send inventory data.

Answer

Set up an AWS Config aggregator in the management account.

Question 12

A financial services company uses AWS Organizations with a multi-account structure: a central security account, a shared services account, and multiple workload accounts. The security team needs to centrally manage and audit all changes to security groups across all accounts. They have implemented AWS Config with an aggregator in the security account. However, they notice that changes to security groups in workload accounts are not appearing in the aggregator. The workload accounts have AWS Config enabled and are recording security group changes. The security account has the necessary cross-account permissions. What is the most likely cause and solution?

Accepted Answer

The security account is not authorized in each workload account's Config settings. The security team must add the security account as an authorized aggregator in each workload account.. AWS Config aggregator requires an authorized aggregator account that is set up in each source account. Without this authorization, the aggregator cannot collect data. Option B is wrong because Config is recording changes. Option C is wrong because CloudTrail is not needed for Config aggregation. Option D is wrong because SCPs do not block Config aggregation.

Answer

AWS CloudTrail is not enabled in workload accounts. The security team must enable CloudTrail.

Answer

Service Control Policies are blocking cross-account access. The security team must modify SCPs to allow Config aggregation.

Answer

AWS Config in workload accounts is not recording security group changes. The security team must enable recording for security groups.

Question 13

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

Accepted Answer

The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.. SCPs apply to all principals in the account, including administrators, and deny actions even if IAM policies allow them. Since the SCP denies s3:PutBucketPolicy, the development team cannot create the bucket policy despite having full admin access. Option A is incorrect because the team does have IAM permissions (admin), but the SCP overrides them. Option C is incorrect because CloudFormation's service role is not the issue; the SCP restriction affects all principals, including CloudFormation. Option D is incorrect because the trust policy of the production account's IAM roles is unrelated to the SCP in the development account.

Answer

The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.

Answer

CloudFormation service role is missing. They need to create a service role with appropriate permissions.

Answer

The production account's IAM roles are not trusted. They need to update the trust policy.

Question 14

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

Accepted Answer

Use IAM policies with conditions based on resource tags to restrict access within the single account.. It allows business units to have their own IAM users and permissions within the single account by using IAM policies with conditions based on resource tags, minimizing administrative overhead and avoiding additional costs associated with multiple accounts. Option A is incorrect because creating an OU within the existing account does not provide separate IAM user management; OUs are for grouping accounts in Organizations, not for user management. Option C is incorrect because while separate accounts with consolidated billing can provide separation, it increases administrative overhead and may lead to higher costs due to minimum usage per account. Option D is incorrect because SCPs are used to manage permissions at the account level, not for individual IAM users; they cannot provide the granular user-level control that the business units require.

Answer

Create an Organizational Unit for each business unit within the existing account.

Answer

Create a separate AWS account for each business unit and use consolidated billing to manage costs.

Answer

Use Service Control Policies to restrict each business unit's access to specific services.

Question 15

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

Accepted Answer

Create an SCP to deny PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that do not meet the requirements.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions that do not meet security requirements across all member accounts. By denying PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that would disable encryption or public access blocks, you enforce compliance at the API level, preventing any non-compliant bucket creation or modification regardless of the account or IAM permissions.

Answer

Use AWS Service Catalog to enforce S3 bucket encryption and public access settings.

Answer

Define a tag policy that requires encryption and public access tags on all S3 buckets.

Answer

Use IAM policies in the management account to restrict S3 permissions for all users.