SAP-C02 Design Solutions for Organizational Complexity Practice Test 17 — 15 Questions

Question 1

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS Backup with a backup policy in AWS Organizations to centrally manage backups across accounts.. Option C is correct because AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags. Option A is wrong because AWS Backup does not have a central vault concept without cross-account backup policies. Option B is wrong because lifecycle manager is for EBS snapshots, not centralized backup management. Option D is wrong because CloudFormation StackSets do not manage backups dynamically based on tags.

Answer

Create a backup plan in each account targeting the tagged instances and store backups in the management account's vault using cross-account backup.

Answer

Use AWS CloudFormation StackSets to deploy a backup plan to each account.

Answer

Use Amazon Data Lifecycle Manager to create cross-account snapshot copies for tagged instances.

Question 2

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

Accepted Answer

The workload accounts have not accepted the resource share invitation.. Option A is correct because RAM requires an explicit acceptance of the resource share by the workload accounts. Until they accept, the subnet is not visible. Option B is wrong because IAM permissions are needed but the issue is acceptance. Option C is wrong because sharing is not limited to the same region. Option D is wrong because default VPC does not affect shared subnets.

Answer

The workload accounts have a default VPC that conflicts with the shared subnet.

Answer

The workload accounts do not have the necessary IAM permissions to use shared subnets.

Answer

The subnet is in a different AWS Region than the workload accounts.

Question 3

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

Accepted Answer

SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.. Option D is correct because SCPs are evaluated before the actual API call, but they cannot see the current state of the bucket. The SCP denies the PutBucketVersioning action only if the condition checks for the current setting, but SCPs cannot access the bucket's current configuration. Therefore, the SCP as described would not block the action. Option A is wrong because SCPs apply to all users. Option B is wrong because SCPs are not optional. Option C is wrong because SCPs do not require explicit allow.

Answer

The SCP is overridden by a service control policy that allows the action.

Answer

The SCP does not have an explicit deny; it uses a default deny.

Answer

The SCP is not applied to the root organizational unit.

Question 4

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.. Option B is correct because a trail in the management account can log management events for all accounts, but it requires that the trail be created with the option 'Apply trail to all accounts in the organization' and the S3 bucket policy must allow CloudTrail to write from member accounts. Option A is wrong because there is no such limitation. Option C is wrong because CloudTrail supports cross-account delivery. Option D is wrong because the bucket policy is likely the issue.

Answer

CloudTrail cannot log management events for member accounts from the management account.

Answer

The trail is configured to log only read events.

Answer

The member accounts have disabled CloudTrail.

Question 5

A company uses AWS Organizations and has a central security account. They want to use AWS Security Hub to aggregate findings from all member accounts. They have enabled Security Hub in the security account and invited all member accounts. However, findings from member accounts are not appearing in the Security Hub console of the security account. What is the most likely cause?

Accepted Answer

The member accounts have not enabled Security Hub and accepted the invitation.. Option D is correct because each member account must enable Security Hub and accept the invitation before findings are aggregated. Option A is wrong because Security Hub supports cross-region aggregation. Option B is wrong because IAM permissions are needed but not the primary cause. Option C is wrong because there is no such requirement.

Answer

The member accounts have not configured Security Hub to send findings to the security account.

Answer

The IAM role used by Security Hub in the security account does not have permissions to read findings from member accounts.

Answer

Security Hub cannot aggregate findings from member accounts in different regions.

Question 6

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to use AWS Transit Gateway to connect VPCs across accounts. The network team has created a Transit Gateway in the network account and shared it using AWS Resource Access Manager (RAM) with the workload accounts. The workload accounts have created VPC attachments to the Transit Gateway. However, traffic is not flowing between the VPCs. The route tables in the workload VPCs have routes pointing to the Transit Gateway. What is the most likely cause?

Accepted Answer

The Transit Gateway route tables do not have routes for the attached VPCs.. Option C is correct because even if the Transit Gateway is shared and attachments are created, the Transit Gateway route tables must have routes for the VPCs to communicate. By default, the Transit Gateway route table does not propagate attachments automatically. Option A is wrong because VPC flow logs are not required. Option B is wrong because the Transit Gateway is not in the same account, but it is shared. Option D is wrong because security groups are within the VPC, not the Transit Gateway.

Answer

The Transit Gateway is in a different AWS account, so route propagation is not automatic.

Answer

The security groups in the workload VPCs are blocking traffic.

Answer

VPC flow logs are not enabled.

Question 7

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

Accepted Answer

Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.. Option B is correct because AWS Config rules can be deployed across accounts using AWS Organizations by enabling the rule with 'All accounts' option. Option A is wrong because SCPs cannot enforce Config rules. Option C is wrong because CloudFormation StackSets can deploy rules but requires manual management. Option D is wrong because Config aggregator only aggregates, not enforces.

Answer

Use the AWS Config aggregator to manually enable the rule in each account.

Answer

Use AWS CloudFormation StackSets to deploy a Config rule template to each account.

Answer

Create an SCP that requires all accounts to enable AWS Config.

Question 8

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AD Connector. AWS Managed Microsoft AD can be deployed in multiple regions and linked to on-premises Active Directory via AD Connector. AWS Identity and Access Management (IAM) integrates with AD for SSO. Option A (AWS SSO) is a separate service that can also be used but is not required; Option C (Cognito) is for external users; Option E (Direct Connect) is a network service. Correct: B and D.

Answer

Amazon Cognito

Answer

AWS Direct Connect

Answer

AWS Single Sign-On (SSO)

Question 9

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

Accepted Answer

Create an organization trail in CloudTrail and store logs in the central bucket. Attach an SCP to the root that denies s3:PutBucketPolicy for the central bucket.. AWS Organizations allows you to create service control policies (SCPs) that can deny actions across accounts. Using an SCP to deny the s3:PutBucketPolicy action on the central bucket ensures that no account can change the bucket policy to block log delivery. Additionally, enabling CloudTrail for all regions and all accounts with an organization trail ensures automatic log delivery. Option A is correct.

Answer

Set up VPC Flow Logs at the VPC level and CloudTrail at the account level, then use Lambda to copy logs to the central bucket.

Answer

Use AWS Config rules to detect when logs are not being sent and automatically re-enable logging.

Answer

Create individual trails per account and use S3 cross-region replication to copy logs to the central bucket.

Question 10

A large enterprise with multiple business units (BUs) uses AWS Organizations with a shared services account and BU-specific accounts. Each BU account has a VPC with multiple subnets. The shared services account hosts a central NAT gateway that provides outbound internet access to all BU private subnets via VPC peering. Recently, the network team noticed that traffic from one BU's private subnet is being blocked by the security group in the shared services account. They verified that the route tables are correctly configured. What is the most likely cause and solution?

Accepted Answer

The security group attached to the NAT gateway's ENI does not allow incoming traffic from the BU private subnet. Update the security group to allow inbound traffic from the BU subnet CIDR.. VPC peering does not support transitive routing. In this setup, traffic from BU private subnets goes to the NAT gateway in the shared services account via VPC peering. However, the NAT gateway's security group must allow inbound traffic from the BU private subnet CIDR. If it does not, traffic will be blocked. The solution is to update the NAT gateway's security group. Option D is correct.

Answer

The BU account's route table does not have a route to the NAT gateway's private IP. Add a route via the VPC peering connection.

Answer

The VPC peering connection is not in the 'active' state. Recreate the VPC peering connection.

Answer

The NAT gateway's Elastic IP is not attached. Attach an Elastic IP to the NAT gateway.

Question 11

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

Accepted Answer

Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.. The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag. Option C allows the services to bypass the tag requirement.

Answer

Remove the SCP from the root.

Answer

Modify the bucket policy to allow s3:PutObject without tags.

Answer

Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

Question 12

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

Accepted Answer

Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.. Option D is correct because an SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Answer

Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

Answer

Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

Answer

Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

Question 13

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.. CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.

Answer

Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.

Answer

Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.

Answer

Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.

Question 14

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

Accepted Answer

Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.. Using CloudFormation stack-level tags with a service control policy (SCP) that requires tags is the correct approach. Option B is incorrect because IAM policies can enforce tags on resources created by CloudFormation. Option C is incorrect because AWS Config can detect but not enforce. Option D is incorrect because CloudFormation does not natively enforce tag propagation without additional mechanisms.

Answer

Create an IAM policy that requires tags on all resources and attach it to all IAM users.

Answer

Configure CloudFormation to reject any stack that does not include tags.

Answer

Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.

Question 15

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

Accepted Answer

Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.. Option C is correct because AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.

Answer

Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.

Answer

Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.

Answer

Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.