SAP-C02 Design Solutions for Organizational Complexity Practice Test 18 — 15 Questions

Question 1

An organization uses AWS Organizations with a multi-account strategy. The security team needs to ensure that all accounts must use AWS CloudTrail with logs delivered to a centralized S3 bucket. They also want to receive notifications if any account disables CloudTrail. What is the MOST efficient solution?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Use an S3 event notification on the centralized bucket to trigger a Lambda function that sends an SNS alert if logs stop arriving.. Option A is correct because it combines a preventive control (SCP) to block CloudTrail disabling actions with a detective control (S3 event notification + Lambda + SNS) to alert if logs stop arriving. The SCP ensures that even if an account has administrative privileges, it cannot stop or delete the trail, while the S3 event notification on the centralized bucket detects the absence of new log files, triggering an alert. This is the most efficient solution as it requires minimal overhead and provides both enforcement and notification.

Answer

Use AWS CloudTrail to log management events and set up a CloudWatch Events rule that triggers on StopLogging API calls.

Answer

Use an SCP that requires all accounts to have a specific trust policy for CloudTrail. Use CloudTrail Insights to detect anomalous activity.

Answer

Deploy a Lambda function in each account that periodically checks CloudTrail status and sends an SNS message if disabled.

Question 2

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.. Option C is correct because an IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Answer

Create a service control policy in AWS Organizations that restricts instance types for all accounts.

Answer

Use AWS Config to automatically terminate instances that are not of allowed types.

Answer

Configure an S3 bucket policy that only allows specific instance types to be used.

Question 3

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

Accepted Answer

Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.. Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Answer

Use Amazon QuickSight to create dashboards from the flow logs.

Answer

Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

Answer

Load the flow logs into Amazon Redshift and run SQL queries.

Question 4

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

Accepted Answer

Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.. Option A is correct because it uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Answer

Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.

Answer

Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.

Answer

Share the EC2 console credentials of each account with the DevOps team.

Question 5

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon RDS

Question 6

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Accepted Answer

AWS CloudTrail can be configured to log management events across all accounts from the management account.. Option C is correct because AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Answer

Accounts cannot be moved between OUs once created.

Answer

Each organizational unit (OU) should contain only one account for security isolation.

Answer

SCPs can only be applied to root accounts, not OUs.

Question 7

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Accepted Answer

Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.. Option B is correct because AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Answer

Enable CloudTrail to log all console logins and alert if MFA is not used.

Answer

Use a service control policy (SCP) to require MFA on all IAM users.

Question 8

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Accepted Answer

Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.. Option A is correct because defining a standardized set of tags and enforcing them with AWS Config rules ensures consistent cost allocation tagging across all accounts in AWS Organizations. AWS Config rules can evaluate resources for tag compliance and trigger remediation actions, such as automatically tagging resources or sending notifications, which is essential for accurate cost tracking. This approach aligns with the AWS Well-Architected Framework's cost optimization pillar by enabling granular cost allocation and chargeback.

Answer

Enable AWS-generated tags automatically for all resources.

Answer

Use service control policies (SCPs) to require tags on all resources.

Answer

Apply tags only at the resource creation time; they cannot be added later.

Question 9

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption. Option C is correct because a service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Answer

Use AWS CloudTrail to monitor and alert on bucket creation without encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Define an IAM policy in each account to deny S3:PutBucket without encryption

Question 10

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

Accepted Answer

Use tag policies in AWS Organizations to enforce tagging on new resources. Option B is correct because tag policies in AWS Organizations allow you to define a set of tagging rules that are enforced across all accounts in the organization. When a tag policy is attached to an organizational root, OU, or account, AWS automatically prevents the creation of resources that do not comply with the specified tags, ensuring that all new resources are tagged correctly from the start without requiring manual remediation or custom scripts.

Answer

Use AWS Config rules to identify untagged resources and send alerts

Answer

Attach an SCP that denies all actions if the resource does not have the cost center tag

Answer

Create a Lambda function that runs daily to tag untagged resources

Question 11

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

Accepted Answer

An IAM role in the production account with a trust policy allowing the development account. Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.

Answer

A VPC peering connection between the accounts

Answer

A service control policy (SCP) that permits AssumeRole

Answer

An AWS Config rule to validate the role

Question 12

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

Accepted Answer

Set up S3 cross-account replication from each account's bucket to the central bucket. Option B is correct because S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Answer

Use a Lambda function in each account to copy logs to the central bucket

Answer

Configure VPC Flow Logs in each account to directly deliver to the central bucket

Answer

Use CloudWatch Logs subscription filter to stream logs to the central account

Question 13

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

Accepted Answer

Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center. To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Answer

Create an IAM role in the member account with permissions to manage Identity Center

Answer

Attach an SCP to the member account allowing Identity Center actions

Answer

Create a new user in the management account with admin privileges

Question 14

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies iam:CreateAccessKey. Option B is correct because an SCP can deny the CreateAccessKey action across all accounts. Option A is wrong because an IAM policy in each account is not centrally managed. Option C is wrong because AWS Config can detect but not prevent. Option D is wrong because CloudTrail is for logging.

Answer

Enable AWS CloudTrail and set up a metric filter for CreateAccessKey

Answer

Apply an IAM policy to all users in each account that denies iam:CreateAccessKey

Answer

Use AWS Config to detect access key creation and trigger a Lambda to delete the key

Question 15

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

Accepted Answer

Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account. Option D is correct because AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.

Answer

Establish VPC peering between the shared services VPC and each developer VPC

Answer

Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account

Answer

Use AWS Systems Manager to automate domain join with a custom document