SAP-C02 Design Solutions for Organizational Complexity Practice Test 17 — 15 Questions

Question 1

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies all actions in non-approved regions.. Service Control Policies (SCPs) in AWS Organizations can be used to deny all actions in non-approved regions by specifying a condition key like 'aws:RequestedRegion' with a list of allowed regions. This effectively prevents developers in any member account from creating or interacting with resources outside the approved set, regardless of their IAM permissions.

Answer

Use IAM policies in each account to deny actions in non-approved regions.

Answer

Define a tag policy using AWS Organizations to enforce cost center tags.

Question 2

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

Accepted Answer

Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.. Deploying an AWS Config rule across all accounts using AWS Organizations allows centralized detection of IAM users without MFA, and using AWS Config custom remediation can automatically disable their access keys. This meets the requirement for central management from the management account. Option A is incorrect because SCPs can deny API calls if MFA is not present, but they cannot disable access keys. Option C is incorrect because IAM Access Analyzer is used for analyzing access policies and does not have the capability to enforce MFA or disable keys. Option D is incorrect because AWS IAM Identity Center is designed for workforce identity and access management, not for managing existing IAM users in member accounts.

Answer

Create an SCP that denies all API calls if the user does not have an MFA device.

Answer

Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.

Answer

Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.

Question 3

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

Accepted Answer

The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.. Even though the IAM role in the workload account has permissions to write to the S3 bucket, the KMS key policy in the logging account must explicitly grant the VPC Flow Logs service principal permission to use the key for encryption. Without this key policy statement, the logs cannot be encrypted and delivered. Option A is incorrect because VPC Flow Logs can be delivered directly to S3 without CloudWatch Logs. Option B is incorrect because a bucket policy denying workload accounts would be an issue, but the question states the IAM role has necessary permissions, and the key policy is the missing piece. Option C is incorrect because encryption in transit is not a common requirement for VPC Flow Logs delivery to S3, and the issue is about encryption at rest using KMS.

Answer

The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

Answer

The S3 bucket policy denies access to the workload accounts.

Answer

The S3 bucket has a bucket policy that requires encryption in transit.

Question 4

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

Accepted Answer

Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.. A trail created in the management account of AWS Organizations can log management events for all member accounts, but data events (such as S3 object-level operations) are logged only for the account that owns the trail. To capture data events from member accounts, each member account must create its own trail and enable data event logging for its S3 buckets. Option A is incorrect because CloudTrail can write to an S3 bucket even without a bucket policy, as long as the bucket is in the same account. Option B is incorrect because the trail was configured to log data events for all S3 buckets, but that setting only applies to the management account, not member accounts. Option D is incorrect because KMS encryption does not affect the ability to log data events; CloudTrail can use the appropriate KMS permissions if configured.

Answer

The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.

Answer

The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.

Answer

The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.

Question 5

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.. AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts. Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Answer

Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

Answer

Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

Answer

Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

Question 6

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

Accepted Answer

Each member account must individually configure the S3 bucket as a publishing destination for its own findings.. For GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place. Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Answer

The GuardDuty detector in the management account is not configured to publish findings to S3.

Answer

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Answer

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

Question 7

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

Accepted Answer

Use AWS Backup with a backup policy in AWS Organizations to centrally manage backups across accounts.. AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags. Option A is wrong because creating a backup plan in each account is not central management and requires manual setup. Option B is wrong because CloudFormation StackSets deploy infrastructure but do not dynamically manage backups based on tags. Option D is wrong because Amazon Data Lifecycle Manager is for automated EBS snapshots, not for centralized backup management across accounts.

Answer

Create a backup plan in each account targeting the tagged instances and store backups in the management account's vault using cross-account backup.

Answer

Use AWS CloudFormation StackSets to deploy a backup plan to each account.

Answer

Use Amazon Data Lifecycle Manager to create cross-account snapshot copies for tagged instances.

Question 8

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

Accepted Answer

The workload accounts have not accepted the resource share invitation.. AWS RAM requires workload accounts to accept the resource share invitation before they can see and use the shared subnet. Option B is incorrect because having a default VPC in the workload account does not prevent visibility of shared subnets; the subnet will appear in the VPC list regardless. Option C is incorrect because the primary issue is the acceptance of the resource share, not IAM permissions; while IAM permissions may be needed to launch instances, the subnet itself will not be visible until the share is accepted. Option D is incorrect because AWS RAM supports sharing across regions, so a different region would not prevent the subnet from being visible after acceptance.

Answer

The workload accounts have a default VPC that conflicts with the shared subnet.

Answer

The workload accounts do not have the necessary IAM permissions to use shared subnets.

Answer

The subnet is in a different AWS Region than the workload accounts.

Question 9

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

Accepted Answer

SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.. The most likely reason is option C: SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters. SCPs do not have visibility into the current configuration of resources like S3 bucket versioning. Therefore, an SCP that attempts to deny PutBucketVersioning if versioning is not enabled cannot work because it cannot check the bucket's current versioning status. This allows users to disable versioning. Option A is incorrect because SCPs are hierarchical and cannot be overridden by another SCP unless there is an explicit allow, but the core issue is the condition evaluation. Option B is incorrect because SCPs use explicit deny, not a default deny. Option D is incorrect because applying the SCP to the root OU would not resolve the fundamental limitation that SCPs cannot check resource state.

Answer

The SCP is overridden by a service control policy that allows the action.

Answer

The SCP does not have an explicit deny; it uses a default deny.

Answer

The SCP is not applied to the root organizational unit.

Question 10

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.. A trail in the management account can log management events for all accounts, but it requires that the trail be created with the option 'Apply trail to all accounts in the organization' and the S3 bucket policy must allow CloudTrail to write from member accounts. Option A is wrong because there is no such limitation. Option C is wrong because CloudTrail supports cross-account delivery. Option D is wrong because the bucket policy is likely the issue.

Answer

CloudTrail cannot log management events for member accounts from the management account.

Answer

The trail is configured to log only read events.

Answer

The member accounts have disabled CloudTrail.

Question 11

A company uses AWS Organizations and has a central security account. They want to use AWS Security Hub to aggregate findings from all member accounts. They have enabled Security Hub in the security account and invited all member accounts. However, findings from member accounts are not appearing in the Security Hub console of the security account. What is the most likely cause?

Accepted Answer

The member accounts have not enabled Security Hub and accepted the invitation.. Each member account must enable Security Hub and accept the invitation before findings are aggregated. Option A is wrong because Security Hub supports cross-region aggregation. Option B is wrong because IAM permissions are needed but not the primary cause. Option C is wrong because there is no such requirement.

Answer

The member accounts have not configured Security Hub to send findings to the security account.

Answer

The IAM role used by Security Hub in the security account does not have permissions to read findings from member accounts.

Answer

Security Hub cannot aggregate findings from member accounts in different regions.

Question 12

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to use AWS Transit Gateway to connect VPCs across accounts. The network team has created a Transit Gateway in the network account and shared it using AWS Resource Access Manager (RAM) with the workload accounts. The workload accounts have created VPC attachments to the Transit Gateway. However, traffic is not flowing between the VPCs. The route tables in the workload VPCs have routes pointing to the Transit Gateway. What is the most likely cause?

Accepted Answer

The Transit Gateway route tables do not have routes for the attached VPCs.. The most likely cause is that the Transit Gateway route tables do not have routes for the attached VPCs. Even though the Transit Gateway is shared and VPC attachments are created, the Transit Gateway route tables must contain routes pointing to the attached VPCs for traffic to flow. By default, VPC attachments are not automatically propagated to the Transit Gateway route table. Option A is incorrect because route propagation is automatic when attachments are created, but only if the route table is configured for propagation. Option C is incorrect because security groups are stateful and allow return traffic; they would not block traffic between VPCs if the correct rules are in place. Option D is incorrect because VPC flow logs are a monitoring tool and do not affect traffic flow.

Answer

The Transit Gateway is in a different AWS account, so route propagation is not automatic.

Answer

The security groups in the workload VPCs are blocking traffic.

Answer

VPC flow logs are not enabled.

Question 13

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

Accepted Answer

Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.. AWS Config conformance packs can be deployed across all accounts in an AWS Organization using the AWS Organizations integration. Conformance packs allow you to deploy a collection of AWS Config rules and remediation actions consistently. Option B is incorrect because the AWS Config aggregator only provides a central view of compliance status; it does not automatically enable rules in member accounts. Option C is incorrect: while CloudFormation StackSets can deploy Config rules, conformance packs are the recommended and more straightforward method for deploying Config rules across an organization. Option D is incorrect because SCPs (Service Control Policies) are used to manage permissions and cannot directly enforce AWS Config rules.

Answer

Use the AWS Config aggregator to manually enable the rule in each account.

Answer

Use AWS CloudFormation StackSets to deploy a Config rule template to each account.

Answer

Create an SCP that requires all accounts to enable AWS Config.

Question 14

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AD Connector. AD Connector (Option C) is correct because it acts as a proxy to redirect authentication requests from AWS services to your on-premises Active Directory without caching credentials or requiring directory synchronization, enabling seamless SSO for users. AWS Managed Microsoft AD (Option E) is correct because it provides a highly available, fully managed Active Directory in the AWS cloud that can be extended to multiple regions via trust relationships, supporting low-latency authentication for thousands of users across regions.

Answer

Amazon Cognito

Answer

AWS Direct Connect

Answer

AWS Single Sign-On (SSO)

Question 15

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

Accepted Answer

Create an organization trail in CloudTrail and store logs in the central bucket. Attach an SCP to the root that denies s3:PutBucketPolicy for the central bucket.. AWS Organizations allows you to create service control policies (SCPs) that can deny actions across accounts. Using an SCP to deny the s3:PutBucketPolicy action on the central bucket ensures that no account can change the bucket policy to block log delivery. Additionally, enabling CloudTrail for all regions and all accounts with an organization trail ensures automatic log delivery. Option C meets both requirements.

Answer

Set up VPC Flow Logs at the VPC level and CloudTrail at the account level, then use Lambda to copy logs to the central bucket.

Answer

Use AWS Config rules to detect when logs are not being sent and automatically re-enable logging.

Answer

Create individual trails per account and use S3 cross-region replication to copy logs to the central bucket.