SAP-C02 Design Solutions for Organizational Complexity Practice Test 19 — 15 Questions

Question 1

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

Accepted Answer

Share the portfolio with the target accounts from the Service Catalog console. Option A is correct because AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Answer

Use AWS CloudFormation StackSets to deploy products to each account

Answer

Use SCPs to allow specific accounts to use Service Catalog

Answer

Create IAM roles in the central account that developers can assume

Question 2

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present. Option A is correct because an S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Answer

Use AWS Config rules to remediate non-compliant objects

Answer

Require users to use pre-signed URLs for uploads

Answer

Attach an SCP that denies s3:PutObject without encryption

Question 3

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

Accepted Answer

Deploy an AWS Config conformance pack across accounts using AWS Organizations.. AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Answer

Use AWS CloudFormation StackSets in each account.

Answer

Create an AWS Lambda function in the management account to enable Config rules.

Answer

Use an SCP to require Config recording.

Question 4

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

Accepted Answer

Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Answer

Use AWS Lambda to re-enable GuardDuty if it is disabled.

Answer

Create an AWS Config rule to detect disabled GuardDuty and send alerts.

Answer

Attach an IAM policy to each user that denies guardduty:Disable* actions.

Question 5

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

Accepted Answer

Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.. Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Answer

Use S3 object-level compression (e.g., gzip) to reduce data volume.

Answer

Create AWS Glue partition indexes on the table.

Answer

Create separate Athena tables for each account and region.

Question 6

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

Accepted Answer

Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.. Option B is correct because it uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Answer

Use AWS PrivateLink to route traffic through the NGFW.

Answer

Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Set up AWS Direct Connect between all VPCs and the inspection VPC.

Question 7

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

Accepted Answer

The users are operating in the management account.. SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Answer

The SCP is attached to the root, not the OU.

Answer

The users have a permissions boundary that allows the actions.

Answer

The SCP's condition key does not match the actual tag.

Question 8

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Accepted Answer

Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.. Option C is correct because it uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Answer

Use AWS PrivateLink to connect each VPC to the network account.

Answer

Create VPC peering connections between each VPC and the network account.

Answer

Assign new non-overlapping CIDR ranges to each VPC and update all resources.

Question 9

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

Accepted Answer

Use the management account to designate the member account as a delegated administrator for IAM Identity Center.. To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Answer

Enable AWS Organizations and create an admin role in the member account.

Answer

Create a new OU for the delegated administrator account.

Answer

Attach an SCP to allow IAM Identity Center actions in the member account.

Question 10

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Answer

AWS IAM

Answer

AWS Control Tower

Answer

AWS Service Catalog

Question 11

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

Accepted Answer

Attach an IAM policy to the user that allows s3:GetObject on the bucket.. Option C is correct because the simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Answer

Create an IAM role in the source account and have the user assume it.

Answer

Update the bucket policy to allow the user's ARN directly.

Answer

Use a bucket ACL to grant access to the user's canonical ID.

Question 12

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Accepted Answer

Enable CloudTrail organization trail from the management account.. Option A is correct because enabling an organization trail from the management account automatically creates a CloudTrail trail for all accounts in the AWS Organization, including future accounts, without requiring per-account configuration. This ensures centralized logging to a single S3 bucket and enforces compliance across the entire organization.

Answer

Create an AWS Lambda function in each account to enable CloudTrail.

Answer

Attach an SCP that requires CloudTrail to be enabled.

Answer

Create an AWS Config rule to detect accounts without CloudTrail.

Question 13

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Accepted Answer

S3 Object Lock. S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 14

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Accepted Answer

Share the IPAM pool using AWS Resource Access Manager (RAM).. Option C is correct because AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Answer

Create a PrivateLink endpoint for IPAM.

Answer

Enable VPC sharing in each member account.

Answer

Set up AWS Direct Connect between accounts.

Question 15

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Answer

Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.

Answer

Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.

Answer

Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.