SAP-C02 Design Solutions for Organizational Complexity Practice Test 19 — 15 Questions

Question 1

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IAM role in the production account with a trust policy allowing the development account. Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.

Answer

A VPC peering connection between the accounts

Answer

A service control policy (SCP) that permits AssumeRole

Answer

An AWS Config rule to validate the role

Question 2

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

Accepted Answer

Set up S3 cross-account replication from each account's bucket to the central bucket. S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Answer

Use a Lambda function in each account to copy logs to the central bucket

Answer

Configure VPC Flow Logs in each account to directly deliver to the central bucket

Answer

Use CloudWatch Logs subscription filter to stream logs to the central account

Question 3

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

Accepted Answer

Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center. To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Answer

Create an IAM role in the member account with permissions to manage Identity Center

Answer

Attach an SCP to the member account allowing Identity Center actions

Answer

Create a new user in the management account with admin privileges

Question 4

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies iam:CreateAccessKey. A Service Control Policy (SCP) attached to the root organizational unit denies the iam:CreateAccessKey action across all accounts in the organization, providing centralized enforcement. Option A is wrong because CloudTrail logs events but does not prevent them. Option B is wrong because applying an IAM policy in each account is not centrally managed and may be overridden by administrator permissions. Option D is wrong because AWS Config detects but cannot prevent the action, and the remediation Lambda may have a delay.

Answer

Enable AWS CloudTrail and set up a metric filter for CreateAccessKey

Answer

Apply an IAM policy to all users in each account that denies iam:CreateAccessKey

Answer

Use AWS Config to detect access key creation and trigger a Lambda to delete the key

Question 5

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

Accepted Answer

Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account. AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.

Answer

Establish VPC peering between the shared services VPC and each developer VPC

Answer

Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account

Answer

Use AWS Systems Manager to automate domain join with a custom document

Question 6

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Share the portfolio with the target accounts from the Service Catalog console. AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Answer

Use AWS CloudFormation StackSets to deploy products to each account

Answer

Use SCPs to allow specific accounts to use Service Catalog

Answer

Create IAM roles in the central account that developers can assume

Question 7

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present. An S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Answer

Use AWS Config rules to remediate non-compliant objects

Answer

Require users to use pre-signed URLs for uploads

Answer

Attach an SCP that denies s3:PutObject without encryption

Question 8

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

Accepted Answer

Deploy an AWS Config conformance pack across accounts using AWS Organizations.. AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Answer

Use AWS CloudFormation StackSets in each account.

Answer

Create an AWS Lambda function in the management account to enable Config rules.

Answer

Use an SCP to require Config recording.

Question 9

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

Accepted Answer

Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Answer

Use AWS Lambda to re-enable GuardDuty if it is disabled.

Answer

Create an AWS Config rule to detect disabled GuardDuty and send alerts.

Answer

Attach an IAM policy to each user that denies guardduty:Disable* actions.

Question 10

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

Accepted Answer

Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.. Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Answer

Use S3 object-level compression (e.g., gzip) to reduce data volume.

Answer

Create AWS Glue partition indexes on the table.

Answer

Create separate Athena tables for each account and region.

Question 11

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

Accepted Answer

Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.. It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Answer

Use AWS PrivateLink to route traffic through the NGFW.

Answer

Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Set up AWS Direct Connect between all VPCs and the inspection VPC.

Question 12

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

Accepted Answer

The users are operating in the management account.. SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Answer

The SCP is attached to the root, not the OU.

Answer

The users have a permissions boundary that allows the actions.

Answer

The SCP's condition key does not match the actual tag.

Question 13

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Accepted Answer

Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.. It uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Answer

Use AWS PrivateLink to connect each VPC to the network account.

Answer

Create VPC peering connections between each VPC and the network account.

Answer

Assign new non-overlapping CIDR ranges to each VPC and update all resources.

Question 14

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

Accepted Answer

Use the management account to designate the member account as a delegated administrator for IAM Identity Center.. To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Answer

Enable AWS Organizations and create an admin role in the member account.

Answer

Create a new OU for the delegated administrator account.

Answer

Attach an SCP to allow IAM Identity Center actions in the member account.

Question 15

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Answer

AWS IAM

Answer

AWS Control Tower

Answer

AWS Service Catalog