SAP-C02 Design Solutions for Organizational Complexity Practice Test 18 — 15 Questions

Question 1

A large enterprise with multiple business units (BUs) uses AWS Organizations with a shared services account and BU-specific accounts. Each BU account has a VPC with multiple subnets. The shared services account hosts a central NAT gateway that provides outbound internet access to all BU private subnets via VPC peering. Recently, the network team noticed that traffic from one BU's private subnet is being blocked by the security group in the shared services account. They verified that the route tables are correctly configured. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC peering connection is not in the 'active' state. Recreate the VPC peering connection.. VPC peering connections must be in the 'active' state to route traffic between VPCs. If the peering connection for a specific BU's VPC is not active (e.g., pending acceptance, expired, or deleted), traffic from that BU's private subnet to the shared services VPC will be blocked. Since route tables and the NAT gateway's configuration are correct, the most likely cause is an inactive VPC peering connection. Option B is incorrect because NAT gateways do not support user-modifiable security groups; AWS manages the security group on the NAT gateway's ENI and it cannot be updated by customers. Option A contradicts the verified route tables. Option D would affect all BUs, not just one.

Answer

The BU account's route table does not have a route to the NAT gateway's private IP. Add a route via the VPC peering connection.

Answer

The security group attached to the NAT gateway's ENI does not allow incoming traffic from the BU private subnet. Update the security group to allow inbound traffic from the BU subnet CIDR.

Answer

The NAT gateway's Elastic IP is not attached. Attach an Elastic IP to the NAT gateway.

Question 2

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

Accepted Answer

Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.. The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag. Option C allows the services to bypass the tag requirement.

Answer

Remove the SCP from the root.

Answer

Modify the bucket policy to allow s3:PutObject without tags.

Answer

Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

Question 3

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

Accepted Answer

Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.. An SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Answer

Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

Answer

Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

Answer

Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

Question 4

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.. CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.

Answer

Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.

Answer

Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.

Answer

Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.

Question 5

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

Accepted Answer

Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.. AWS Organizations Service Control Policies (SCPs) can deny the creation of CloudFormation stacks that do not include required stack-level tags, while stack-level tags defined in the template propagate to all resources created by the stack. This combination enforces tagging standards across all stacks without relying on individual IAM user permissions or post-creation remediation.

Answer

Create an IAM policy that requires tags on all resources and attach it to all IAM users.

Answer

Configure CloudFormation to reject any stack that does not include tags.

Answer

Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.

Question 6

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

Accepted Answer

Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.. AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.

Answer

Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.

Answer

Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.

Answer

Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.

Question 7

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.. An IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Answer

Create a service control policy in AWS Organizations that restricts instance types for all accounts.

Answer

Use AWS Config to automatically terminate instances that are not of allowed types.

Answer

Configure an S3 bucket policy that only allows specific instance types to be used.

Question 8

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

Accepted Answer

Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.. Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Answer

Use Amazon QuickSight to create dashboards from the flow logs.

Answer

Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

Answer

Load the flow logs into Amazon Redshift and run SQL queries.

Question 9

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

Accepted Answer

Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.. It uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Answer

Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.

Answer

Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.

Answer

Share the EC2 console credentials of each account with the DevOps team.

Question 10

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon RDS

Question 11

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Accepted Answer

AWS CloudTrail can be configured to log management events across all accounts from the management account.. AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Answer

Accounts cannot be moved between OUs once created.

Answer

Each organizational unit (OU) should contain only one account for security isolation.

Answer

SCPs can only be applied to root accounts, not OUs.

Question 12

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Accepted Answer

Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.. AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Answer

Enable CloudTrail to log all console logins and alert if MFA is not used.

Answer

Use a service control policy (SCP) to require MFA on all IAM users.

Question 13

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Accepted Answer

Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.. Defining a standardized set of tags and enforcing them with AWS Config rules ensures consistent cost allocation tagging across all accounts in AWS Organizations. AWS Config rules can evaluate resources for tag compliance and trigger remediation actions, such as automatically tagging resources or sending notifications, which is essential for accurate cost tracking. This approach aligns with the AWS Well-Architected Framework's cost optimization pillar by enabling granular cost allocation and chargeback.

Answer

Enable AWS-generated tags automatically for all resources.

Answer

Use service control policies (SCPs) to require tags on all resources.

Answer

Apply tags only at the resource creation time; they cannot be added later.

Question 14

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption. A service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Answer

Use AWS CloudTrail to monitor and alert on bucket creation without encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Define an IAM policy in each account to deny S3:PutBucket without encryption

Question 15

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

Accepted Answer

Use tag policies in AWS Organizations to enforce tagging on new resources. Tag policies in AWS Organizations allow you to define a set of tagging rules that are enforced across all accounts in the organization. When a tag policy is attached to an organizational root, OU, or account, AWS automatically prevents the creation of resources that do not comply with the specified tags, ensuring that all new resources are tagged correctly from the start without requiring manual remediation or custom scripts.

Answer

Use AWS Config rules to identify untagged resources and send alerts

Answer

Attach an SCP that denies all actions if the resource does not have the cost center tag

Answer

Create a Lambda function that runs daily to tag untagged resources