SAP-C02 Design Solutions for Organizational Complexity Practice Test 17 — 15 Questions

Question 1

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 2

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

Accepted Answer

Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.. AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Answer

Use an SCP that denies all IAM actions except those from a specific admin account.

Answer

Use an IAM password policy that requires multi-factor authentication for all users.

Answer

Create an IAM role in each account with full administrator access and use a break-glass process to assume it.

Question 3

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Accepted Answer

Create an SCP that denies s3:PutObject unless encryption headers are included.. Option A is correct because a service control policy (SCP) attached in AWS Organizations can deny s3:PutObject requests that lack the required encryption headers (for example x-amz-server-side-encryption), preventing unencrypted object uploads across all 100 accounts. Option E is correct because AWS Config rules such as s3-bucket-server-side-encryption-enabled can detect buckets without default encryption, and an auto-remediation action invoking a Lambda function can enable default encryption (PutBucketEncryption) automatically. Option B is not correct as written because SCPs cannot require encryption headers in the way described; SCPs only allow or deny actions, and the enforcement mechanism is a deny condition, not a requirement statement. Option C addresses S3 Block Public Access, which is unrelated to encryption enforcement. Option D denies s3:CreateBucket entirely, which would block legitimate bucket creation rather than enforce encryption.

Answer

Create an SCP that requires all objects to be uploaded with server-side encryption.

Answer

Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.

Answer

Create an SCP that denies the s3:CreateBucket action to all accounts.

Question 4

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Accepted Answer

Use AWS Resource Access Manager to share resources only with trusted accounts.. Option B is correct because AWS Resource Access Manager (RAM) lets the company share resources such as subnets, Transit Gateways, and Route 53 Resolver rules only with explicitly specified trusted accounts, which enforces a trusted-account boundary and prevents unintended cross-account data access. Option C is correct because AWS Organizations service control policies (SCPs) can be attached to the organization root or OUs to deny access to external AWS accounts unless explicitly allowed, providing a preventive guardrail that blocks data exfiltration to untrusted accounts across all member accounts. Option A is not the best fit because blocking public S3 access and restricting cross-account access addresses only S3, not a data perimeter across all AWS accounts and services. Option D is not correct because VPC endpoints keep traffic private to AWS but do not by themselves prevent exfiltration to external accounts or the internet. Option E is not correct because security groups filter traffic by IP/port and cannot reliably enforce a data perimeter against exfiltration to arbitrary external destinations.

Answer

Disable public access to all S3 buckets and restrict cross-account access.

Answer

Use VPC endpoints for all AWS services and ensure they are private.

Answer

Use security groups to restrict outbound traffic to known IP addresses.

Question 5

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

Accepted Answer

Use AWS Config rules in each account to detect non-compliant buckets and trigger auto-remediation.. Using AWS Config rules deployed via StackSets across all accounts in the organization provides a scalable and maintainable way to detect non-compliant buckets (e.g., those without SSE-KMS encryption) and trigger auto-remediation to enforce encryption. This approach is proactive and centralized, while still being scalable via AWS Organizations. Option A is incorrect because the SCP actions mentioned (s3:PutBucketAcl and s3:PutBucketPolicy) do not control encryption settings. Option B is only detective and does not enforce compliance. Option D does not address encryption enforcement.

Answer

Apply a service control policy (SCP) at the root OU that denies s3:PutBucketAcl or s3:PutBucketPolicy actions unless encryption is configured.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the security team.

Answer

Create a CloudFormation StackSet that deploys an S3 bucket policy in every account.

Question 6

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

Accepted Answer

Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.. Using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.

Answer

Allow s3:GetObject to the SIEM's IAM role.

Answer

Use an S3 access point with a network origin policy.

Answer

Allow s3:GetObject to the SIEM's AWS account ID.

Question 7

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.. AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Answer

Manually enable Shield Advanced in each account after creation.

Answer

Use AWS Config to detect accounts without Shield Advanced and send notifications.

Answer

Use AWS Organizations to create an SCP that requires Shield Advanced.

Question 8

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

Accepted Answer

Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.. Using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect VPCs to the shared services VPC.

Answer

Use a single TGW route table for all attachments and control traffic with security groups.

Question 9

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Share the approved AMIs from the central account with all other accounts.. Sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.

Answer

Use AWS CloudFormation Guard to validate templates before deployment.

Answer

Use AWS Service Catalog to create a product for approved AMIs.

Question 10

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Answer

AWS Config

Answer

Amazon ECS

Answer

AWS OpsWorks

Question 11

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Option B is correct because an AWS Organizations Service Control Policy (SCP) attached to the 'Production' OU sets the maximum permissions for every account in that OU, so a deny statement for cloudtrail:StopLogging, cloudtrail:DeleteTrail, and the related S3 delete actions (e.g., s3:DeleteObject, s3:DeleteBucket) prevents any principal in those accounts from disabling CloudTrail or removing its logs, even account root users. Option D is correct because a bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject (and ideally s3:DeleteObjectVersion) to principals in the Production OU provides a resource-based control that blocks deletion of the log objects themselves, complementing the SCP. Option A is not correct because CloudTrail Insights only detects and reports unusual write activity; it is a detective control and does not prevent anyone from stopping trails or deleting logs. Option C is not correct because a permissions boundary only limits the maximum permissions of a specific IAM principal it is attached to, not all accounts in an OU, and it cannot constrain the account root user or other principals that lack the boundary.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 12

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

Accepted Answer

Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.. Option A is correct because enforcing the presence of a 'CostCenter' tag at launch time requires an Allow statement for ec2:RunInstances with a condition such as "StringEquals": {"aws:RequestTag/CostCenter": "..."} (or a Null check on aws:RequestTag/CostCenter), which validates the tag supplied in the RunInstances request. Option B is correct because restricting developers to specific instance types is done by adding a condition to the ec2:RunInstances Allow statement, typically using "StringEquals" or "ForAllValues:StringEquals" on ec2:InstanceType with the allowed list of instance types. Option C is incorrect because an unconditional Allow ec2:RunInstances would let developers launch any instance type without the required CostCenter tag, violating both requirements. Option D is incorrect because a Deny on instance type alone does not enforce the mandatory 'CostCenter' tag and is not the intended mechanism here; the requirement is satisfied by scoping the Allow with conditions rather than relying solely on a Deny.

Answer

Allow ec2:RunInstances without conditions.

Answer

Deny ec2:RunInstances if the instance type is not in the allowed list.

Question 13

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Accepted Answer

Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.. Option B is correct because association of a VPC with a Route 53 private hosted zone is an API action (AssociateVPCWithHostedZone) that can be tightly controlled with IAM policies, so restricting those permissions to authorized principals is the primary way to prevent unauthorized VPCs from being associated and thus resolving records. Option C is correct because cross-account associations must be explicitly authorized: the VPC owner calls the Route 53 authorize-vpc-association (authorize zone association) API to create an authorization, and the hosted zone owner then associates the VPC, ensuring only VPCs whose owners have been granted authorization can be linked to the zone. Option D is correct because AWS Resource Access Manager (AWS RAM) is the supported mechanism for sharing a Route 53 private hosted zone with other AWS accounts, letting the central account control exactly which accounts (and therefore which VPCs) may associate with the zone. Option A is not correct because a Resolver forwarding rule simply routes queries to target IP addresses and does not itself govern which VPCs are authorized to resolve a private hosted zone. Option E is not correct because VPC peering provides network connectivity between VPCs but does not grant or restrict Route 53 private hosted zone association or resolution permissions.

Answer

Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.

Answer

Create a VPC peering connection between the central account and each VPC.

Question 14

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

Accepted Answer

The write is allowed because the policy grants access to the root of account 123456789012.. The S3 bucket policy grants access to the root user of account 123456789012 (the `Principal` is the AWS account root user via the account ARN). When a service in that account writes to the bucket, the request is made on behalf of the account, and the root user effectively owns all identities in the account. The policy allows `s3:PutObject` on the `AWSLogs/123456789012/*` prefix, so the write to `s3://my-log-bucket/AWSLogs/123456789012/logfile.txt` is permitted. Option B correctly identifies that the root user grant covers the service's action.

Answer

The write is denied because the principal is the root user, not an IAM role.

Answer

The write is denied because the policy only allows GetObject, not PutObject.

Answer

The write is allowed only if the object key is exactly 'AWSLogs/123456789012/'.

Question 15

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

Accepted Answer

Enable AWS CloudTrail in the master account and log sts:AssumeRole events.. AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Answer

Create an IAM Access Analyzer in each member account to monitor cross-account access.

Answer

Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

Answer

Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.