SAP-C02 Design Solutions for Organizational Complexity Practice Test 20 — 15 Questions

Question 1

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM policy to the user that allows s3:GetObject on the bucket.. The simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Answer

Create an IAM role in the source account and have the user assume it.

Answer

Update the bucket policy to allow the user's ARN directly.

Answer

Use a bucket ACL to grant access to the user's canonical ID.

Question 2

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Accepted Answer

Enable CloudTrail organization trail from the management account.. Enabling an organization trail from the management account automatically creates a CloudTrail trail for all accounts in the AWS Organization, including future accounts, without requiring per-account configuration. This ensures centralized logging to a single S3 bucket and enforces compliance across the entire organization.

Answer

Create an AWS Lambda function in each account to enable CloudTrail.

Answer

Attach an SCP that requires CloudTrail to be enabled.

Answer

Create an AWS Config rule to detect accounts without CloudTrail.

Question 3

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Accepted Answer

S3 Object Lock. S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 4

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Accepted Answer

Share the IPAM pool using AWS Resource Access Manager (RAM).. AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Answer

Create a PrivateLink endpoint for IPAM.

Answer

Enable VPC sharing in each member account.

Answer

Set up AWS Direct Connect between accounts.

Question 5

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Answer

Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.

Answer

Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.

Answer

Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.

Question 6

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Answer

Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.

Answer

Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.

Answer

Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.

Question 7

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.. Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Answer

Use AWS Config rules to detect and automatically delete any new users or keys.

Answer

Enable AWS CloudTrail and create a metric filter to alert on these actions.

Answer

Attach an IAM policy to the Administrator role in each account that denies these actions.

Question 8

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.. AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Answer

Use AWS Service Catalog to enforce tagging on EC2 products.

Answer

Use AWS Resource Access Manager to share a tagging policy across accounts.

Answer

Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

Question 9

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack in each account that creates a bucket with encryption and versioning, and use SCPs to prevent deletion.. AWS CloudFormation StackSets allow you to deploy a standardized stack across multiple accounts in an organization, ensuring that any bucket created by the stack has encryption and versioning enabled. Combining this with a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified (Option D) provides a preventive guardrail at the organization level. Additionally, deploying AWS Config rules with auto-remediation (Option C) acts as a detective and corrective measure, ensuring compliance even if buckets are created outside the approved stack.

Answer

Create IAM policies in each account that require encryption and versioning for any bucket creation.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts.

Question 10

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances with an ec2:InstanceType condition key that does not match approved families.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny ec2:RunInstances for non-approved instance types using the ec2:InstanceType condition key. This enforces the restriction across all accounts without requiring per-account IAM changes, and SCPs act as a guardrail that cannot be overridden by account administrators.

Answer

Use AWS Service Catalog to create a product that launches approved instances, and require developers to launch only through Service Catalog.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate unauthorized instances.

Answer

Create an IAM role in each account with a policy that restricts instance types, and require developers to use that role.

Question 11

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization.. AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.

Answer

Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.

Answer

Apply an SCP to require CloudTrail to be enabled in all accounts.

Question 12

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Accepted Answer

Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.. VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Answer

Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

Answer

Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

Answer

Place a network load balancer in each VPC and capture traffic using a packet sniffer.

Question 13

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Answer

Create an IAM policy that requires the security group when launching instances with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Answer

Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.

Question 14

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Accepted Answer

Create an AWS Config aggregator in the security account to view compliance status across accounts.. An AWS Config aggregator in the security account collects compliance data from all member accounts, providing a centralized view of rule compliance across the organization. This enables the security team to monitor and audit compliance without logging into each account individually.

Answer

Apply a service control policy (SCP) that requires AWS Config to be enabled.

Answer

Use AWS CloudTrail to monitor compliance status.

Question 15

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

Accepted Answer

Register the member account as a delegated administrator for CloudTrail in AWS Organizations.. Registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Answer

Create a resource-based policy on the CloudTrail service to allow the member account to create trails.

Answer

Create an IAM role in the management account and grant the developer permission to assume it.

Answer

Attach an SCP to the member account that allows CloudTrail actions.