SAP-C02 Design Solutions for Organizational Complexity Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To ensure that only requests originating from accounts within the specified organization are allowed.. The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Answer

To restrict access to only the root user of the management account.

Answer

To enforce that all requests are made using HTTPS.

Answer

To allow access only from specific IP addresses within the organization.

Question 2

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The trail was created in a different region and the command did not specify a region.. The AWS CLI command `aws cloudtrail lookup-events` defaults to the region configured in the AWS CLI profile (e.g., `us-east-1`). If the CloudTrail trail was created in a different region, the command will return no results unless the `--region` parameter is explicitly specified. Since the security team knows the trail was created in January 2024, the most likely reason for the empty result is that the command did not target the correct region.

Answer

The start time is too far in the past and CloudTrail only retains events for 90 days.

Answer

The trail was created using the AWS Management Console, not the CLI.

Answer

The command syntax is incorrect; the --lookup-attributes parameter should be --attribute.

Question 3

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Accepted Answer

It denies all actions if the request is not made over HTTPS.. This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS. Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Answer

It denies all actions if the request does not include multi-factor authentication.

Answer

It denies all actions from IP addresses outside the corporate network.

Answer

It allows all actions as long as the request is made over HTTPS.

Question 4

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.. A service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Answer

Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

Answer

Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

Question 5

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

Accepted Answer

Use AWS Control Tower account factory and AWS CloudFormation StackSets to deploy the VPC across all accounts.. AWS Control Tower's Account Factory combined with AWS CloudFormation StackSets enables automated, centralized deployment of identical VPC configurations across all 50 accounts in the same Region. StackSets allow you to deploy a CloudFormation template to multiple accounts and Regions from a single administrator account, ensuring consistency without manual intervention.

Answer

Use AWS CloudFormation templates manually triggered in each account.

Answer

Create a VPC in one account and share it with other accounts using AWS Resource Access Manager (RAM).

Answer

Use AWS Organizations to create the VPC in each account via an SCP.

Question 6

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. Option A is correct because S3 server access logging must be enabled on each source bucket, and its target can be a bucket in another account, so each bucket's logs can be delivered directly to the central S3 bucket in the logging account. Option D is correct because a CloudTrail trail must be created in each account (or via an organization trail) with an S3 bucket in the centralized logging account configured as the trail's storage location, which is how CloudTrail log files reach the central bucket. Option E is correct because the central bucket's bucket policy must grant cross-account write permissions (s3:PutObject, and typically s3:GetBucketAcl) to the CloudTrail service principal in each source account, otherwise CloudTrail cannot deliver logs to a bucket owned by another account. Option B is not required because CloudWatch Logs subscription filters stream log events to destinations such as Lambda or Kinesis, not directly into an S3 bucket, and CloudTrail/S3 access logs are delivered to S3 natively. Option C is not required because CloudTrail Insights detects unusual API activity and does not capture or deliver S3 access logs to the central bucket.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.

Question 7

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Accepted Answer

License configurations. AWS RAM supports sharing several resource types across accounts within an organization. Option A (License configurations) is correct because AWS License Manager license configurations are a shareable RAM resource type, allowing member accounts to use centrally managed licensing rules. Option B (Subnets) is correct because VPC subnets are explicitly shareable via RAM, which is exactly the scenario described—sharing a centrally managed subnet across multiple accounts. Option C (Transit gateways) is correct because Transit Gateway is a supported RAM resource type, enabling centralized network connectivity across accounts. Option D (VPC peering connections) is not shareable via RAM; peering connections are established between VPCs and are not a RAM resource type. Option E (Security groups) is not shareable via RAM; security groups are account-scoped and cannot be shared across accounts through RAM.

Answer

VPC peering connections

Answer

Security groups

Question 8

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

Accepted Answer

Attach an SCP that denies the restricted instance types to the OU.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Answer

Use AWS CloudTrail to monitor and alert when restricted instance types are launched.

Answer

Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.

Answer

Attach an SCP to the root of the organization and exclude the management account.

Question 9

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Accepted Answer

Designate a delegated administrator account for GuardDuty in AWS Organizations.. Designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Answer

Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.

Answer

Create a new S3 bucket in each account to store GuardDuty findings.

Question 10

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.. AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Answer

Use AWS Config rules to enforce the IAM role creation in each account.

Answer

Manually create the IAM role in each account using the AWS Management Console.

Answer

Use AWS Organizations to create the IAM role via a service control policy (SCP).

Question 11

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.. AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Answer

AWS PrivateLink to route traffic through a centralized security appliance in a single account.

Answer

VPC Peering connections between all VPCs and use security groups to control traffic.

Answer

AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.

Question 12

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

Accepted Answer

Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.. S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Answer

Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

Answer

Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

Question 13

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

Accepted Answer

Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.. AWS Cost Categories allow you to group costs based on shared tags, accounts, or other dimensions across multiple accounts in an AWS Organization. This is the most scalable approach for tracking costs by project when resources span multiple accounts, as it centralizes cost allocation without requiring manual tag activation per account.

Answer

Create separate AWS accounts for each project and use consolidated billing to view costs.

Answer

Use AWS Budgets with cost allocation tags to track project costs.

Answer

Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.

Question 14

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

Accepted Answer

Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.. AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Answer

Use AWS Organizations service control policies to deny cross-account access.

Answer

Use AWS Trusted Advisor to check for unused cross-account roles.

Answer

Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

Question 15

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon S3 Select to retrieve only the relevant log entries based on the IP address and time range.. Amazon S3 Select allows you to retrieve only a subset of data from an object using SQL expressions, making it highly cost-effective for scanning large log files for specific IP addresses and time ranges. It reduces the amount of data transferred and processed compared to reading the entire object, and it scales automatically without provisioning any infrastructure. This approach is ideal for ad-hoc queries on structured or semi-structured log data stored in S3.

Answer

Use Amazon Athena to query the logs directly in S3.

Answer

Stream the logs to Amazon OpenSearch Service for real-time querying.

Answer

Use AWS Glue to catalog the logs and query with Amazon Redshift Spectrum.