SAP-C02 Design Solutions for Organizational Complexity Practice Test 20 — 15 Questions

Question 1

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.. Option C is correct because AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Answer

Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.

Answer

Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.

Answer

Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.

Question 2

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.. Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Answer

Use AWS Config rules to detect and automatically delete any new users or keys.

Answer

Enable AWS CloudTrail and create a metric filter to alert on these actions.

Answer

Attach an IAM policy to the Administrator role in each account that denies these actions.

Question 3

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.. Option A is correct because AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Answer

Use AWS Service Catalog to enforce tagging on EC2 products.

Answer

Use AWS Resource Access Manager to share a tagging policy across accounts.

Answer

Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

Question 4

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack in each account that creates a bucket with encryption and versioning, and use SCPs to prevent deletion.. Option B is correct because AWS CloudFormation StackSets allow you to deploy a standardized stack across multiple accounts in an organization, ensuring that any bucket created by the stack has encryption and versioning enabled. Combining this with a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified (Option D) provides a preventive guardrail at the organization level. Additionally, deploying AWS Config rules with auto-remediation (Option C) acts as a detective and corrective measure, ensuring compliance even if buckets are created outside the approved stack.

Answer

Create IAM policies in each account that require encryption and versioning for any bucket creation.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts.

Question 5

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances with an ec2:InstanceType condition key that does not match approved families.. Option B is correct because a service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny ec2:RunInstances for non-approved instance types using the ec2:InstanceType condition key. This enforces the restriction across all accounts without requiring per-account IAM changes, and SCPs act as a guardrail that cannot be overridden by account administrators.

Answer

Use AWS Service Catalog to create a product that launches approved instances, and require developers to launch only through Service Catalog.

Answer

Deploy an AWS Config rule that triggers a Lambda function to terminate unauthorized instances.

Answer

Create an IAM role in each account with a policy that restricts instance types, and require developers to use that role.

Question 6

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization.. Option A is correct because AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.

Answer

Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.

Answer

Apply an SCP to require CloudTrail to be enabled in all accounts.

Question 7

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Accepted Answer

Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.. Option B is correct because VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Answer

Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

Answer

Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

Answer

Place a network load balancer in each VPC and capture traffic using a packet sniffer.

Question 8

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Answer

Create an IAM policy that requires the security group when launching instances with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Answer

Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.

Question 9

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Accepted Answer

Create an AWS Config aggregator in the security account to view compliance status across accounts.. Option B is correct because an AWS Config aggregator in the security account collects compliance data from all member accounts, providing a centralized view of rule compliance across the organization. This enables the security team to monitor and audit compliance without logging into each account individually.

Answer

Apply a service control policy (SCP) that requires AWS Config to be enabled.

Answer

Use AWS CloudTrail to monitor compliance status.

Question 10

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

Accepted Answer

Register the member account as a delegated administrator for CloudTrail in AWS Organizations.. Option A is correct because registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Answer

Create a resource-based policy on the CloudTrail service to allow the member account to create trails.

Answer

Create an IAM role in the management account and grant the developer permission to assume it.

Answer

Attach an SCP to the member account that allows CloudTrail actions.

Question 11

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies creation of S3 buckets without encryption. Option C is correct because a service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted buckets

Answer

Enable S3 default encryption in each account

Answer

Use S3 bucket policies to require encryption

Question 12

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

Accepted Answer

Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts. Option B is correct because VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket

Answer

Create VPC endpoints in each account to connect to the central S3 bucket

Answer

Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group

Question 13

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

Accepted Answer

Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity. Option A is correct because cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Answer

Apply a service control policy to allow cross-account access

Answer

Create an IAM user in the production account and share the credentials with the development team

Answer

Configure security group rules to allow access from the development account

Question 14

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. Option C is correct because it leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 15

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Option C is correct because cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account