SAP-C02 Design Solutions for Organizational Complexity Practice Test 2 — 15 Questions

Question 1

A company is implementing a new multi-account strategy using AWS Organizations. The central IT team wants to delegate management of certain AWS services to individual account administrators while maintaining centralized governance. Which TWO actions should the team take? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create SCPs that allow all actions except those managed centrally.. SCPs can be used to allow all actions except those managed centrally, effectively delegating management of non-centrally-managed services to individual account administrators while central IT retains control over specified services. Option C is correct because CloudFormation StackSets enable the central IT team to deploy baseline resources (e.g., IAM roles, security groups) consistently across all accounts, ensuring centralized governance while allowing local administrators to manage other aspects. Option A is incorrect because creating IAM roles assumable from the central account centralizes management, not delegates it to local administrators. Options D and E are incorrect due to security and governance risks.

Answer

Create IAM roles in each account that can be assumed from the central account with limited permissions.

Answer

Share the root user credentials of each account with the respective administrator.

Answer

Grant each account administrator full access to the management account.

Question 2

A company has a multi-account AWS environment with 50 accounts. They need to implement a centralized logging solution for VPC Flow Logs, CloudTrail, and AWS Config logs. The logs must be stored in a central S3 bucket and encrypted with a customer-managed KMS key. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create an S3 bucket policy that grants permissions to the CloudTrail and AWS Config service principals from all accounts to write logs.. To meet the requirements, three steps are necessary. First, option A: an S3 bucket policy must be created in the central account to grant the CloudTrail and AWS Config service principals from all 50 accounts the necessary permissions (e.g., s3:PutObject) to write logs into the central S3 bucket. Without this policy, cross-account log delivery would fail. Second, option C: CloudTrail must be configured in each account to deliver logs to the central S3 bucket. Each account's CloudTrail trail should specify the central S3 bucket as the destination. Third, option D: a customer-managed KMS key must be created with a key policy that allows the CloudTrail and AWS Config service principals to use the key for encryption. This ensures logs are encrypted at rest using the customer-managed key. Option B (AWS Config aggregator) is not required for S3 storage; it aggregates configuration data but does not store logs in S3. Option E (VPC Flow Logs to CloudWatch Logs) does not meet the requirement of storing logs in a central S3 bucket; VPC Flow Logs can be delivered directly to S3, but the question asks for three steps, and the correct ones are A, C, and D.

Answer

Use AWS Config aggregator to collect configuration data from all accounts into a central account.

Answer

Enable VPC Flow Logs in each account and deliver them to a central CloudWatch Logs group.

Question 3

An organization uses AWS Organizations with a multi-account strategy. The security team needs to ensure that all accounts must use AWS CloudTrail with logs delivered to a centralized S3 bucket. They also want to receive notifications if any account disables CloudTrail. What is the MOST efficient solution?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail. Use an S3 event notification on the centralized bucket to trigger a Lambda function that sends an SNS alert if logs stop arriving.. The SCP blocks disabling actions. To detect if logs stop arriving, a scheduled CloudWatch Events rule invokes a Lambda function that calls the DescribeTrails API and checks the last log delivery time. If logs have not been delivered recently, an SNS alert is sent. This combined approach provides both prevention and detection.

Answer

Use AWS CloudTrail to log management events and set up a CloudWatch Events rule that triggers on StopLogging API calls.

Answer

Use an SCP that requires all accounts to have a specific trust policy for CloudTrail. Use CloudTrail Insights to detect anomalous activity.

Answer

Deploy a Lambda function in each account that periodically checks CloudTrail status and sends an SNS message if disabled.

Question 4

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with a specific KMS key. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the specified KMS key is used.. Using an SCP at the root OU prevents any account from creating unencrypted buckets or using a different KMS key because SCPs affect all principals in the account. Option A is wrong because AWS Config rules only detect non-compliance and require a separate remediation action; they do not prevent the action. Option C is wrong because a bucket policy can enforce encryption on objects but not on the bucket encryption settings themselves, and managing StackSets across accounts is less efficient than a single SCP. Option D is wrong because managing IAM policies per account at scale is cumbersome and does not prevent root users.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them retroactively.

Answer

Deploy a CloudFormation StackSet that creates a bucket policy in each account requiring encryption.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless the specified KMS key is used.

Question 5

A company uses AWS Organizations with hundreds of accounts. They want to centrally manage VPC security group rules to ensure that only approved CIDR ranges are allowed for SSH access. Which solution is MOST scalable and auditable?

Accepted Answer

Use AWS CloudFormation StackSets to deploy security groups with approved rules, and use an SCP to deny creation or modification of security groups outside of CloudFormation.. It combines CloudFormation StackSets for deploying approved security groups across hundreds of accounts with an SCP that denies ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress actions unless they originate from CloudFormation (using the aws:ViaAWSService condition key). This ensures that only centrally managed, auditable deployments can create or modify security groups, providing both scalability and a clear audit trail via CloudFormation change sets and StackSet operations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remove the offending rules.

Answer

Create an SCP that denies ec2:AuthorizeSecurityGroupIngress for SSH ports unless the CIDR is in an approved list.

Answer

Use AWS Firewall Manager to centrally manage security group rules across accounts.

Question 6

A company is using AWS Organizations with multiple accounts. The central IT team wants to enforce that all EC2 instances are launched with specific tags (e.g., CostCenter and Environment). The solution should prevent any untagged instances from being created. Which approach should be taken?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.. AWS Organizations SCPs can centrally enforce tag requirements by denying the ec2:RunInstances action when required tags are not specified in the request. While IAM policies can also use condition keys like aws:RequestTag to enforce tags, managing individual IAM policies across many accounts is less efficient and harder to maintain. SCPs provide a preventive control that applies to all principals in an account, ensuring consistent enforcement without relying on detection and remediation.

Answer

Use AWS Service Catalog to provision EC2 instances only from pre-configured products that include required tags.

Answer

Use an AWS Config rule to detect untagged instances and trigger a Lambda function to terminate them.

Answer

Create an IAM policy for each account that requires tags on instance creation.

Question 7

A company is using AWS Organizations with multiple accounts. The security team wants to enforce encryption at rest for all Amazon S3 buckets across the organization. The solution must be automated and should not prevent existing compliant buckets from being used. Which TWO services should be combined to achieve this?

Accepted Answer

AWS Config. AWS Config is correct because it can continuously monitor S3 bucket configurations against a custom rule that checks for default encryption or bucket policies enforcing encryption at rest. When a non-compliant bucket is detected, AWS Config can trigger an automated remediation action via Systems Manager Automation to enable encryption without disrupting existing compliant buckets. AWS CloudFormation StackSets is correct because it allows you to deploy the AWS Config rules and associated remediation actions across all accounts in the organization in a scalable and automated manner, ensuring consistent enforcement of encryption requirements.

Answer

AWS Lambda

Answer

AWS Trusted Advisor

Answer

Service control policy (SCP)

Question 8

A multinational corporation is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have server-side encryption enabled, and any new bucket created without encryption must be automatically remediated. Which TWO steps should the team take to achieve this? (Choose two.)

Accepted Answer

Use a CloudWatch Events rule to trigger a Lambda function that enables encryption on any new bucket. A CloudWatch Events rule (now Amazon EventBridge) can detect the 'CreateBucket' API call and trigger an AWS Lambda function that automatically enables server-side encryption on the newly created bucket. This provides real-time, event-driven remediation without manual intervention, ensuring compliance immediately after bucket creation.

Answer

Use an IAM policy to deny s3:PutBucketEncryption without encryption settings

Answer

Use AWS Trusted Advisor to check bucket encryption and send alerts

Answer

Use AWS Config with a managed rule to detect non-compliant buckets and an auto-remediation action

Question 9

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

Accepted Answer

Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.. SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Answer

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Answer

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Answer

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Question 10

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.

Question 11

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.. AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Answer

Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

Answer

Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

Answer

Use an SCP to require CloudTrail to be enabled in each account.

Question 12

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Accepted Answer

The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.. The S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Answer

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Answer

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Answer

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Question 13

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

Accepted Answer

An SCP that denies the effect of actions that modify billing preferences.. A Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Answer

An SCP that allows only read-only billing actions.

Answer

An SCP that denies all billing-related actions except read-only.

Answer

An IAM policy attached to the root OU that denies billing modifications.

Question 14

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.

Question 15

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Accepted Answer

Use an SCP to prevent disabling of AWS Config in any account.. AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Answer

Manually create an S3 bucket in each account to store Config logs.

Answer

Create an IAM role in each account to allow the management account to access Config logs.