SAP-C02 Design Solutions for Organizational Complexity Practice Test 18 — 15 Questions

Question 1

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.. AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Answer

Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

Answer

Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

Answer

Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

Question 2

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

Accepted Answer

Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.. Service control policies (SCPs) are the correct mechanism to centrally restrict AWS service actions across all accounts in an AWS Organization. By attaching an SCP that denies actions in unapproved Regions to the root or OUs, the security team ensures that no principal (including the root user) can create resources outside the allowed Regions, regardless of any IAM policies attached at the account level.

Answer

Create a resource-based policy on each resource type that denies creation in unapproved Regions.

Answer

Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

Answer

Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

Question 3

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

Accepted Answer

Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.. The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity. Therefore, only Option A fully meets the requirements.

Answer

Create a separate pipeline in each account using the same source repository.

Answer

Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.

Question 4

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

Accepted Answer

Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.. AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Answer

Use S3 access points in each account to grant access to the central bucket.

Answer

Create an S3 interface endpoint in the logging account and share it with other accounts.

Answer

Copy logs to each account's own S3 bucket and run Athena queries locally.

Question 5

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

Accepted Answer

Attach a service control policy (SCP) that denies sts:AssumeRole if the aws:PrincipalOrgID condition is not set.. A service control policy (SCP) can centrally enforce that all IAM role trust policies in member accounts require the `aws:PrincipalOrgID` condition key. This condition ensures that only principals within the organization can assume roles, blocking any external user from assuming a role even if the role's trust policy is misconfigured. SCPs apply to all accounts in an OU or organization, providing a preventive control that cannot be overridden by account administrators.

Answer

Enable AWS CloudTrail to log role assumptions and send alerts when external assumptions occur.

Answer

Use AWS Config to detect roles with external trust relationships and automatically delete them.

Answer

Modify the trust policy of each IAM role to allow only principals from the organization.

Question 6

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

Accepted Answer

AWS IAM Identity Center.. AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

Amazon Cognito user pools.

Answer

AWS Identity and Access Management (IAM) with SAML federation.

Question 7

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.. Option A is correct because an SCP attached at the organization or OU level can enforce a deny on s3:PutBucket* actions (such as s3:PutBucketEncryption or s3:PutBucketPolicy) unless the request includes the required SSE parameters, giving preventive, organization-wide enforcement across all accounts. Option E is correct because AWS Config provides the s3-bucket-server-side-encryption-enabled managed rule to detect non-compliant buckets, and its automatic remediation action can re-apply default encryption, providing detective and corrective enforcement across the multi-account environment. Option B is wrong because setting default encryption to 'disable encryption' is the opposite of the requirement and AWS S3 default encryption cannot be disabled in that manner. Option C is wrong because CloudTrail plus Lambda is a reactive, custom-built monitoring approach, not a native enforcement mechanism, and it does not guarantee prevention. Option D is wrong because IAM policies attached to users and roles are identity-based and cannot reliably enforce encryption on all buckets across all accounts, especially for service principals or resources not covered by those identities.

Answer

Set the default encryption on each bucket to disable encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.

Answer

Create an IAM policy with a global condition for SSE and attach it to all users and roles.

Question 8

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.. Option E is correct because service control policies (SCPs) in AWS Organizations, which Control Tower relies on, set the maximum permissions for accounts in an OU; an SCP with a Deny for actions outside the approved Region (using a condition such as aws:RequestedRegion) prevents users and roles in those accounts from creating or managing resources in unapproved Regions, enforcing the requirement at the organizational level. Option A is correct because AWS Config rules can detect resources deployed in unapproved Regions and, combined with automatic remediation (for example an SSM Automation document), can remediate or delete non-compliant resources, providing detective and corrective enforcement that complements the preventive SCP. Option B is not appropriate because IAM policies attached to roles can be modified or bypassed by principals with sufficient permissions and do not provide the centralized, account-level guardrail that SCPs do. Option C is incorrect because IAM Identity Center (formerly AWS SSO) controls user access and permission sets, not the Regions in which accounts may deploy resources. Option D is incorrect because CloudTrail with SNS only records and notifies about API activity in unapproved Regions; it detects but does not enforce or remediate the requirement.

Answer

Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.

Answer

Configure AWS IAM Identity Center to restrict access to approved Regions.

Answer

Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.

Question 9

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with a specific KMS key. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the specified KMS key is used.. Using an SCP at the root OU prevents any account from creating unencrypted buckets or using a different KMS key because SCPs affect all principals in the account. Option A is wrong because AWS Config rules only detect non-compliance and require a separate remediation action; they do not prevent the action. Option C is wrong because a bucket policy can enforce encryption on objects but not on the bucket encryption settings themselves, and managing StackSets across accounts is less efficient than a single SCP. Option D is wrong because managing IAM policies per account at scale is cumbersome and does not prevent root users.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them retroactively.

Answer

Deploy a CloudFormation StackSet that creates a bucket policy in each account requiring encryption.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless the specified KMS key is used.

Question 10

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Deploy an AWS Transit Gateway and attach all VPCs (business unit and shared services) to it.. AWS Transit Gateway acts as a hub-and-spoke router, allowing all VPCs (business units and shared services) to connect through a single gateway. This minimizes latency by using the AWS global network backbone and maximizes throughput with up to 50 Gbps per VPC attachment, scaling horizontally across multiple attachments. It simplifies management compared to mesh peering and avoids the bandwidth limitations of VPN or PrivateLink for inter-VPC routing.

Answer

Create a VPN connection from each business unit VPC to the shared services VPC.

Answer

Use AWS PrivateLink to connect services in the shared services VPC to the business unit VPCs.

Answer

Set up VPC peering between each business unit VPC and the shared services VPC.

Question 11

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

Accepted Answer

AWS Cost Explorer with cost allocation tags.. Cost allocation tags in AWS allow you to tag resources (e.g., EC2 instances, S3 buckets) with department IDs and then use AWS Cost Explorer to view cost breakdowns by those tags. This directly meets the requirement to track costs per department account within AWS Organizations with consolidated billing.

Answer

AWS Budgets with tag-based filters.

Answer

AWS Trusted Advisor cost optimization checks.

Answer

AWS Cost Explorer with tag-based filtering.

Question 12

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

Accepted Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.. AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Answer

Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.

Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.

Answer

Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.

Question 13

A company uses AWS Organizations with hundreds of accounts. They want to centrally manage VPC security group rules to ensure that only approved CIDR ranges are allowed for SSH access. Which solution is MOST scalable and auditable?

Accepted Answer

Use AWS CloudFormation StackSets to deploy security groups with approved rules, and use an SCP to deny creation or modification of security groups outside of CloudFormation.. It combines CloudFormation StackSets for deploying approved security groups across hundreds of accounts with an SCP that denies ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress actions unless they originate from CloudFormation (using the aws:ViaAWSService condition key). This ensures that only centrally managed, auditable deployments can create or modify security groups, providing both scalability and a clear audit trail via CloudFormation change sets and StackSet operations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remove the offending rules.

Answer

Create an SCP that denies ec2:AuthorizeSecurityGroupIngress for SSH ports unless the CIDR is in an approved list.

Answer

Use AWS Firewall Manager to centrally manage security group rules across accounts.

Question 14

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

Accepted Answer

Use AWS Organizations to define a tag policy that mandates the cost center tag.. Option A is correct because AWS Organizations tag policies let you define and enforce a standard tag key such as cost center across all accounts in the organization, and they report noncompliant resources for supported services. Option C is correct because CloudFormation templates can require tags on the resources they create, and StackSets deploy those templates consistently to multiple accounts and Regions, ensuring every provisioned resource carries the cost center tag. Option D is correct because an SCP with a Deny condition such as aws:RequestTag/cost center (or aws:TagKeys) blocks creation of resources that lack the required tag in services that support tag-on-create conditions, providing preventive enforcement. Option B is not correct because AWS Config rules are detective, not preventive, and a Lambda remediation adds tags only after the resource exists, which does not enforce tagging at creation. Option E is not correct because Cost Explorer only reports and visualizes costs, including untagged spend, but cannot enforce or apply tags.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.

Answer

Enable AWS Cost Explorer to report on untagged resources.

Question 15

Refer to the exhibit. A security engineer applied this bucket policy to an S3 bucket. A developer tries to upload an object using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload fails because the policy denies PutObject when encryption is not KMS with the specific key.. The bucket policy includes a Deny statement that explicitly denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms and the x-amz-server-side-encryption-aws-kms-key-id header matching the specific KMS key ARN. Since the developer does not specify any encryption, the condition fails, and the Deny statement applies, causing the upload to fail.

Answer

The upload succeeds because the policy only denies if encryption is not KMS.

Answer

The upload fails because the bucket policy is malformed and rejects all requests.

Answer

The upload succeeds because the developer is using the AWS CLI with default encryption settings.