SAP-C02 Design Solutions for Organizational Complexity Practice Test 2 — 15 Questions

Question 1

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Accepted Answer

Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.. Option C is correct because partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Answer

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Answer

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Answer

Use Athena with federated query to scan logs directly from the application accounts.

Question 2

A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?

Accepted Answer

Deploy AD in two Regions, attach both VPCs to a transit gateway in the primary Region, and use a transit gateway inter-Region peering attachment. Configure route tables to force traffic through the inspection VPC in the primary Region.. Option D is correct because it uses a transit gateway in the primary Region with an inter-Region peering attachment to the secondary Region, allowing AD traffic to be routed through the inspection VPC in the primary Region for firewall inspection. This meets the security policy requirement that all cross-Region AD traffic must traverse the transit gateway and be inspected by the third-party firewall appliance.

Answer

Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.

Answer

Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.

Answer

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.

Question 3

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.. A service control policy (SCP) at the OU level can deny the s3:CreateBucket action unless the request includes both the x-amz-bucket-object-locked-enabled-for-bucket-creation header (for versioning) and the x-amz-server-side-encryption-aws-kms-key-id header (for KMS encryption). This enforces compliance at the API level with no ongoing overhead, as the SCP is evaluated before the bucket is created, preventing noncompliant buckets from existing at all.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.

Question 4

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

Accepted Answer

Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.. Option D is correct because AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Answer

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Answer

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Answer

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Question 5

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

Accepted Answer

Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.. Option B is correct because it combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Answer

Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

Answer

Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

Answer

Use AWS Trusted Advisor to check for root user usage and generate a weekly report.

Question 6

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Accepted Answer

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Answer

Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

Answer

Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

Answer

Enable AWS Resource Access Manager to share resources only with trusted accounts.

Question 7

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. Option A is correct because StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 8

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

Accepted Answer

Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.. Option A is correct because Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.

Answer

Increase the size of the firewall instances to larger instance types to handle more traffic per instance.

Answer

Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.

Answer

Configure the auto-scaling group to use a step scaling policy based on network throughput.

Question 9

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.. The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Answer

The CloudWatch Logs subscription filter does not have permissions to write to Firehose.

Answer

The OpenSearch cluster's access policy denies write access from the Firehose stream.

Answer

The Firehose delivery stream does not have a TLS certificate configured.

Question 10

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Accepted Answer

Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.. Option B is correct because establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Answer

Configure an IAM identity provider to use the on-premises Active Directory.

Answer

Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

Answer

Deploy AWS Managed Microsoft AD in each account and configure replication.

Question 11

A financial services company is migrating its trading platform to AWS. The platform consists of hundreds of microservices deployed in containers using Amazon ECS with Fargate launch type. Each service has its own IAM role for fine-grained permissions. The security team requires that all ECS tasks use a specific VPC (vpc-12345) and cannot run in any other VPC. During a recent audit, it was discovered that some tasks are running in a different VPC (vpc-67890). The solutions architect must implement a preventive control to ensure that ECS tasks only run in the approved VPC. The company uses AWS Organizations and has Service Control Policies (SCPs) in place. What should the solutions architect do?

Accepted Answer

Create an SCP that denies ecs:RunTask and ecs:CreateService unless the networkConfiguration.awsvpcConfiguration.subnets are in the approved VPC.. Option C is correct because Service Control Policies (SCPs) in AWS Organizations provide a preventive control that applies across all accounts in the organization. By denying ecs:RunTask and ecs:CreateService unless the subnets specified in networkConfiguration.awsvpcConfiguration belong to the approved VPC (vpc-12345), the SCP enforces the VPC constraint at the organization level, preventing any task from launching in a non-approved VPC regardless of individual IAM roles or account configurations.

Answer

Tag the approved VPC and use IAM policies to allow ECS actions only when the VPC tag matches.

Answer

Add an IAM policy to each ECS task role that denies the action if the VPC is not the approved one.

Answer

Use AWS Config rules to detect tasks running in non-approved VPCs and trigger a remediation action.

Question 12

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Question 13

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Question 14

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

Question 15

Match each AWS service to its primary use case.