SAP-C02 Design Solutions for Organizational Complexity Practice Test 2 — 15 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. Option A is correct because the management account needs an IAM role (often called StackSetsAdminRole) with permissions to call CloudFormation StackSet APIs and create stack instances in the member accounts. Option C is correct because the execution role assumed in each member account must have permissions to create the actual resources defined in the template, such as VPCs and subnets. Option E is correct because the management account must be able to assume the execution role in each member account, which requires a trust policy on that role allowing the management account to perform sts:AssumeRole. Option B is not required because SCPs are used to restrict maximum permissions, not to grant the permissions needed for StackSets deployment. Option D is incorrect because it describes a self-managed execution role, but the scenario uses AWS Organizations-managed StackSets, where the service-linked role AWSCloudFormationStackSetExecutionRole is created automatically in member accounts rather than being manually configured.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 2

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

Accepted Answer

Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.. Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.

Answer

Increase the size of the firewall instances to larger instance types to handle more traffic per instance.

Answer

Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.

Answer

Configure the auto-scaling group to use a step scaling policy based on network throughput.

Question 3

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.. The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Answer

The CloudWatch Logs subscription filter does not have permissions to write to Firehose.

Answer

The OpenSearch cluster's access policy denies write access from the Firehose stream.

Answer

The Firehose delivery stream does not have a TLS certificate configured.

Question 4

A financial services company is migrating its trading platform to AWS. The platform consists of hundreds of microservices deployed in containers using Amazon ECS with Fargate launch type. Each service has its own IAM role for fine-grained permissions. The security team requires that all ECS tasks use a specific VPC (vpc-12345) and cannot run in any other VPC. During a recent audit, it was discovered that some tasks are running in a different VPC (vpc-67890). The solutions architect must implement a preventive control to ensure that ECS tasks only run in the approved VPC. The company uses AWS Organizations and has Service Control Policies (SCPs) in place. What should the solutions architect do?

Accepted Answer

Create an SCP that denies ecs:RunTask and ecs:CreateService unless the networkConfiguration.awsvpcConfiguration.subnets are in the approved VPC.. Service Control Policies (SCPs) in AWS Organizations provide a preventive control that applies across all accounts in the organization. By denying ecs:RunTask and ecs:CreateService unless the subnets specified in networkConfiguration.awsvpcConfiguration belong to the approved VPC (vpc-12345), the SCP enforces the VPC constraint at the organization level, preventing any task from launching in a non-approved VPC regardless of individual IAM roles or account configurations.

Answer

Tag the approved VPC and use IAM policies to allow ECS actions only when the VPC tag matches.

Answer

Add an IAM policy to each ECS task role that denies the action if the VPC is not the approved one.

Answer

Use AWS Config rules to detect tasks running in non-approved VPCs and trigger a remediation action.

Question 5

Match each AWS disaster recovery strategy to its description.

Accepted Answer

Backup and Restore: Data is backed up to S3 and restored when needed.. AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Answer

Backup and Restore: A scaled-down version of the environment runs and can be scaled up quickly.

Answer

Pilot Light: Data is backed up to S3 and restored when needed.

Question 6

A company uses AWS Organizations with multiple OUs. The security team wants to prevent all accounts in the 'Production' OU from using non-compliant EC2 instance types, but allow exceptions for specific accounts. Which combination of controls should be used?

Accepted Answer

Use resource tags to identify compliant instances and enforce via IAM conditions.. Using resource tags combined with IAM conditions in Service Control Policies (SCPs) allows enforcement at the OU level while enabling exceptions. A Deny SCP can be attached to the Production OU that denies ec2:RunInstances for non-compliant instance types unless the resource has a specific tag (e.g., 'Compliant: true'). Exception accounts can then tag their instances with the required tag to bypass the denial. This approach effectively uses IAM condition keys within an SCP, not IAM policies attached to accounts, and provides a scalable mechanism for exceptions.

Answer

Use AWS Config rules to mark non-compliant instances and use AWS Lambda to terminate them.

Answer

Use IAM policies to deny non-compliant instance types for the Production OU, and attach a different IAM policy to exception accounts.

Answer

Use an SCP to deny non-compliant instance types at the OU level, and use resource-based policies on exception accounts to allow them.

Question 7

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

Accepted Answer

Use a shared VPC with separate subnets for each team, with IAM policies to control access.. A shared VPC allows the central IT team to own and manage the networking resources (VPC, subnets, route tables, etc.) while each application team can independently manage their own EC2 instances and RDS databases within their designated subnets. IAM policies can be scoped to restrict each team to only their subnets and resources, achieving clear separation of duties without requiring multiple VPCs or complex connectivity.

Answer

Use AWS Transit Gateway to connect individual VPCs managed by each team.

Answer

Create a single VPC and use VPC peering to connect team resources.

Answer

Create a separate VPC for each application team and use VPC peering.

Question 8

A company has multiple AWS accounts and wants to centralize logging from all accounts to a single S3 bucket in a logging account. The logs must be encrypted with a KMS key managed by the logging account. What is the MOST secure way to allow cross-account S3 server access logs?

Accepted Answer

Use a bucket policy in the logging account that grants the S3 log delivery service principal access to write objects, and configure the KMS key policy to allow the log delivery service to use the key.. S3 server access logs are delivered by the S3 log delivery service, which operates under the service principal `log-delivery.log.amazonaws.com`. To allow cross-account log delivery to a KMS-encrypted bucket, the bucket policy must grant `s3:PutObject` to that service principal, and the KMS key policy must grant `kms:GenerateDataKey` and `kms:Decrypt` to the same service principal. This ensures the logging account retains full control of the key while enabling secure, auditable log delivery from any source account.

Answer

Set the bucket policy to allow the source accounts to write logs, and enable default encryption on the bucket with the KMS key.

Answer

Create an IAM role in the logging account and allow the source accounts to assume it, then configure the source accounts to use that role for logging.

Answer

Configure the logging account's KMS key with a policy that allows the S3 service to use it, and set the bucket policy to allow the source accounts to write logs.

Question 9

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

Accepted Answer

Use SAML 2.0 federation between AWS SSO and the on-premises AD.. AWS IAM Identity Center (formerly AWS SSO) can integrate with an on-premises Active Directory using SAML 2.0 federation. This involves configuring a SAML 2.0 identity provider (such as Active Directory Federation Services) to federate with IAM Identity Center. Option C is incorrect because it describes combining AWS Managed Microsoft AD and AD Connector, which is not a valid integration method. The correct approaches are either using AD Connector alone or AWS Managed Microsoft AD with a trust, not both together. Other options are not viable direct integration methods.

Answer

Use AWS IAM Identity Center with an external identity provider that supports SCIM.

Answer

Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.

Answer

Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

Question 10

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

Accepted Answer

Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.. VPC Flow Logs can be published to an S3 bucket in a different account by using a resource-based bucket policy that grants the VPC Flow Logs service principal (delivery.logs.amazonaws.com) write access. Additionally, since the logs must be encrypted at rest with a KMS key in the logging account, the KMS key policy must also grant the same service principal the kms:Encrypt and kms:Decrypt permissions. This combination allows the cross-account delivery service to write encrypted objects directly into the logging account's bucket.

Answer

Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

Answer

Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

Answer

In the source account, create a KMS key and allow the logging account to use it for encryption.

Question 11

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.. AWS Organizations Service Control Policies (SCPs) allow the central IT team to define a permission guardrail that explicitly denies actions on networking resources (e.g., ec2:CreateVpc, ec2:DeleteSubnet) for developer accounts. SCPs are applied at the account or organizational unit level and cannot be overridden by any IAM policy within the account, ensuring developers cannot modify networking resources even if they have full administrative access.

Answer

Use IAM roles to grant developers access only to their own resources.

Answer

Use AWS Config rules to detect changes to networking resources.

Answer

Use resource tags to identify networking resources and apply IAM conditions.

Question 12

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.. Option B is correct because enabling MFA delete on the CloudTrail S3 bucket requires multi-factor authentication to permanently delete object versions or change the bucket's versioning state, preventing a compromised or malicious principal from wiping the logs. Option C is correct because S3 bucket versioning preserves every object version and S3 Object Lock (in compliance mode) enforces a WORM retention period, so even an authorized user cannot delete or overwrite CloudTrail log objects before the retention date. Option D is correct because an SCP attached at the account or OU level in AWS Organizations explicitly denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, which blocks even the account root user or an administrator from disabling or deleting the trail. Option A is not sufficient because IAM group policies only restrict identities within the account and can be bypassed by the root user or by anyone who can modify the policies, so it does not provide the hard, tamper-resistant guarantee the scenario requires. Option E is a useful defense-in-depth practice for log isolation, but it is not one of the three actions that directly prevent disabling CloudTrail or deleting the bucket, and it is not marked correct here.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 13

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The policy denies all instance types except t3.micro and t3.small.. The IAM policy includes a Deny statement that explicitly denies ec2:RunInstances for any instance type that is not t3.micro or t3.small. Since the developer is attempting to launch a t3.medium instance, which is not listed in the allowed types, the Deny statement matches and overrides any Allow, resulting in an AccessDenied error. This is the most likely reason because explicit Deny always takes precedence over Allow in IAM policy evaluation logic.

Answer

The policy has a syntax error that causes all actions to be denied.

Answer

The policy does not explicitly allow ec2:RunInstances.

Answer

The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.

Question 14

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

Accepted Answer

The bucket policy restricts access to a specific account only.. The bucket policy restricts access to a specific AWS account (e.g., `"AWS": "111122223333"`), which only grants access to the account's root user, not to IAM roles. For the cross-account IAM role 'LogDelivery' to write logs, the bucket policy must explicitly allow the role's ARN or use `"AWS": "arn:aws:iam::111122223333:root"` to include all IAM principals in the account. Since the policy only allows the account root, the role is denied, causing the delivery failure. Option B is correct because the policy's account-only restriction does not cover the role.

Answer

The bucket policy lacks s3:GetObject permission.

Answer

The IAM role is not trusted by the bucket policy.

Answer

The bucket policy has an explicit deny that overrides the allow.

Question 15

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

Accepted Answer

The account has an unpaid AWS bill.. When an AWS account is suspended, the most common reason is an unpaid bill. AWS suspends accounts that have outstanding charges beyond the payment due date, disabling access to resources until the balance is paid. The command output showing the 'Prod' account as 'SUSPENDED' directly indicates a billing issue, as AWS does not suspend accounts for SCP violations, security breaches, or removal from an organization in the same manner.

Answer

The account was suspended due to a Service Control Policy (SCP) violation.

Answer

The account was suspended due to a security breach detected by AWS.

Answer

The account was removed from the organization by the root user.