SAP-C02 Design Solutions for Organizational Complexity Practice Test 20 — 15 Questions

Question 1

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

Accepted Answer

Apply an SCP that denies all actions if the principal does not have MFA.. Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor and disable users without MFA.

Answer

Set an IAM password policy that requires MFA for all users.

Question 2

A company uses AWS Organizations with a central logging account. They want to ensure that all VPC Flow Logs from member accounts are published to a central S3 bucket in the logging account. Which steps are required?

Accepted Answer

Configure VPC Flow Logs in each member account to deliver to a central S3 bucket using a bucket policy.. VPC Flow Logs can be published directly to an S3 bucket in a different account by configuring the destination S3 bucket with a bucket policy that grants the required permissions (e.g., `AWS:SourceAccount` and `AWS:SourceArn`) to the member account's VPC Flow Logs service. This allows each member account to write flow logs directly to the central logging account's S3 bucket without needing intermediate services, aligning with AWS Organizations' centralized logging best practices.

Answer

Use Amazon Kinesis Data Firehose to stream logs to the central bucket.

Answer

Create a CloudWatch Logs subscription in the central account that receives logs from all accounts.

Answer

Create a CloudWatch Logs log group in each member account and use a subscription filter to forward to a central S3 bucket via Kinesis.

Question 3

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

Accepted Answer

Use an SCP with an Allow effect for allowed services.. Option B is correct because an AWS Organizations Service Control Policy (SCP) with an Allow effect establishes the maximum set of permissions for accounts in the development OU, so only the explicitly allowed services can be used. Option E is correct because an SCP with a Deny effect for services not allowed also restricts the OU's accounts, since SCPs act as permission guardrails that deny actions regardless of IAM policies. Both SCP approaches are applied at the OU level in AWS Organizations, which efficiently covers all 100 accounts without per-account changes. Option A is not correct because CloudFormation StackSets deploy resources but do not enforce service-level permission boundaries. Option C is not correct because AWS Config rules only detect and report noncompliance, they do not prevent service usage. Option D is not correct because IAM policies in each account are cumbersome and do not provide the centralized OU-level restriction that SCPs do.

Answer

Use AWS CloudFormation StackSets to enforce service usage.

Answer

Use AWS Config rules to detect disallowed services.

Answer

Use IAM policies in each account to deny services.

Question 4

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (A) is correct because it records all AWS API calls across accounts, and in a multi-account setup it can be configured as an organization trail to deliver events centrally. Amazon CloudWatch Logs (B) is correct because CloudTrail can stream its events to a central CloudWatch Logs log group, enabling centralized storage, search, and monitoring of API activity. Together, CloudTrail captures the API calls and CloudWatch Logs aggregates them for centralized analysis. Amazon GuardDuty (C) is a threat detection service, not a logging service. Amazon S3 (D) can store CloudTrail logs but is not the service used to centralize and query API call logs in this context. AWS Config (E) tracks resource configuration changes, not all API calls.

Answer

Amazon GuardDuty

Answer

Amazon S3

Answer

AWS Config

Question 5

A company wants to implement a data perimeter to ensure that only authorized accounts can access their S3 buckets. Which TWO steps should they take?

Accepted Answer

Use SCPs to deny access from external accounts.. Option A is correct because AWS Organizations service control policies (SCPs) can be attached to accounts or OUs to explicitly deny S3 actions when the requesting principal belongs to an external account, enforcing a hard boundary that even account administrators cannot override. Option C is correct because an S3 bucket policy using the aws:SourceAccount condition restricts access to requests originating from a specific, trusted AWS account, which is a core mechanism for building a data perimeter around S3 buckets. Together these controls ensure only authorized accounts can reach the buckets. Option B is not correct because VPC endpoints with bucket policies control private network access paths, not which external accounts are authorized. Option D is not correct because CloudTrail only records API activity for auditing and does not prevent unauthorized access. Option E is not correct because AWS Network Firewall filters VPC traffic and does not govern S3 bucket-level account authorization.

Answer

Use VPC endpoints with bucket policies.

Answer

Enable CloudTrail to log access.

Answer

Use AWS Network Firewall.

Question 6

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

Accepted Answer

Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.. An SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.

Answer

Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.

Answer

Use S3 bucket policies to deny PutObject if encryption is not set.

Question 7

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

Accepted Answer

Use AWS Transit Gateway with VPN attachments between the central networking account and each member account VPC.. AWS Transit Gateway with VPN attachments enables encrypted traffic between the central networking account and each member account VPC using IPsec tunnels. This satisfies the encryption-in-transit requirement while ensuring all traffic routes through the central networking account, preventing direct account-to-account access. Transit Gateway also allows all accounts to share a single VPC for workloads without creating separate VPCs.

Answer

Use AWS Client VPN to connect each account to the central VPC.

Answer

Use VPC Peering between the central VPC and each member account VPC.

Answer

Use AWS Direct Connect between accounts.

Question 8

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CloudFormation Guard to validate templates before deployment.. Option C is correct because AWS CloudFormation Guard is a policy-as-code tool that can validate CloudFormation templates against rules before deployment, allowing the security team to reject any template that defines an S3 bucket without encryption settings, thus preventing non-compliant buckets from being created via CloudFormation. Option E is correct because an SCP in AWS Organizations can be attached to accounts or OUs to deny the s3:CreateBucket action unless the request includes the required encryption headers (e.g., x-amz-server-side-encryption), effectively enforcing encryption at bucket creation time across all accounts. Option A is not correct because an IAM permissions boundary only limits the maximum permissions an identity can have; it does not inspect or enforce encryption settings on S3 bucket creation requests. Option B is not correct because S3 Block Public Access only controls public access to buckets and does not enforce server-side encryption. Option D is not correct because the AWS Config managed rule s3-bucket-server-side-encryption-enabled only detects and reports non-compliant buckets after creation; it does not prevent the creation of unencrypted buckets.

Answer

Use an IAM permissions boundary for all IAM roles.

Answer

Use S3 Block Public Access at the account level.

Answer

Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled.

Question 9

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

Accepted Answer

Enable the RI discount sharing feature in the management account.. Option B is correct because enabling RI (Reserved Instance) and Savings Plans discount sharing in the management account ensures that unused discounts are applied across all accounts in the organization, giving finance an accurate, consolidated view of effective costs per department rather than charging each account the full on-demand rate. Option C is correct because cost allocation tags must be activated in the Billing and Cost Management console before AWS will include them as line items in cost reports, which is the prerequisite for breaking costs down by department. Option E is correct because AWS Organizations tag policies define and enforce a consistent tagging standard (for example, a mandatory Department key) across all member accounts, which is what makes department-level cost allocation reliable and uniform. Option A is not needed because detailed billing reports are a legacy feature and are not required for department-level allocation in an Organizations consolidated billing setup. Option D is not needed because Cost and Usage Reports are delivered to a single S3 bucket from the management account and automatically include all member accounts' usage, so enabling CUR per member account is unnecessary and would fragment the data.

Answer

Enable detailed billing reports in the management account.

Answer

Enable AWS Cost and Usage Reports (CUR) for each member account.

Question 10

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Accepted Answer

Use a service control policy that denies access to the unwanted services and attach it to the development OU.. Option C is correct because an SCP that explicitly denies the unwanted services can be attached directly to the development OU, and since SCPs are evaluated at every level of the hierarchy, the deny takes effect for accounts in that OU while leaving other OUs untouched. Option D is correct for the same reason: attaching a deny SCP to the development OU scopes the restriction to that OU only, and explicit Deny statements in SCPs override the permissive root-level SCP that allows all services. Option A is incorrect because tag policies only standardize and enforce tagging of resources; they do not restrict which AWS services can be used. Option B is incorrect because modifying the root-level SCP would affect every OU in the organization, not just development. Option E is incorrect because IAM permissions boundaries limit the maximum permissions of individual IAM entities, not an entire OU, and they are not an Organizations-level control for restricting services across accounts.

Answer

Apply a tag policy to the development OU that requires tags for all resources.

Answer

Modify the root-level SCP to deny the unwanted services.

Answer

Create an IAM permissions boundary for all users in the development OU.

Question 11

A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable AWS CloudTrail in the management account with organization trail, and configure the trail to deliver logs to an S3 bucket in the management account.. Enabling an organization trail in the management account automatically applies CloudTrail to all accounts in the AWS Organization, delivering logs to a single S3 bucket in the management account without any per-account configuration or additional replication mechanisms. This meets the 7-year retention requirement with the least operational overhead, as the trail is centrally managed and logs are stored directly in the central bucket.

Answer

Enable CloudTrail in each account and use S3 Cross-Region Replication to copy logs to a central bucket.

Answer

Use Amazon Kinesis Data Firehose to stream CloudTrail logs from each account to a central S3 bucket.

Answer

Enable CloudTrail in each account individually and configure log file delivery to a bucket in that account.

Question 12

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

Accepted Answer

Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.. AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Answer

Use IAM Access Analyzer to detect and report IAM user creation.

Answer

Use an SCP to deny iam:CreateUser across all accounts.

Answer

Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

Question 13

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a bucket in the logging account with a KMS key. Grant the necessary permissions to the VPC Flow Logs service in each account to write to that bucket using the KMS key. Enable VPC Flow Logs in each account to publish to the central bucket.. It uses a central S3 bucket in the logging account with a customer-managed KMS key, which satisfies the encryption-at-rest requirement. By granting the VPC Flow Logs service principal in each account the necessary permissions to write to the central bucket and use the KMS key, logs are delivered directly without additional infrastructure. This approach minimizes operational overhead by avoiding replication, streaming services, or per-account bucket management.

Answer

Create a bucket in the logging account with default S3-managed encryption and enable VPC Flow Logs in each account to publish to that bucket.

Answer

Create a bucket in each account with KMS encryption and use S3 Cross-Region Replication to copy logs to the central bucket.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket with KMS encryption.

Question 14

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

Accepted Answer

Use Route 53 Resolver outbound endpoints and forwarding rules to forward DNS queries to the appropriate private hosted zones.. Route 53 Resolver outbound endpoints allow you to forward DNS queries from your VPCs to custom DNS resolvers or to other private hosted zones. By creating outbound endpoints and forwarding rules, you can centrally route DNS queries from any VPC to the appropriate private hosted zone associated with another VPC, enabling cross-VPC DNS resolution without requiring VPC peering or complex associations.

Answer

Create VPC peering connections between all VPCs and enable the 'Allow DNS resolution from peered VPC' option.

Answer

Configure Route 53 Resolver inbound endpoints in each VPC and set up conditional forwarding.

Answer

Associate each private hosted zone with each VPC using Route 53.

Question 15

A company has a global AWS environment with multiple VPCs in different regions. The company uses AWS Transit Gateway to connect VPCs in the same region, but they need to interconnect VPCs across regions. The network team wants a solution that provides transitive routing across regions with minimal latency and operational overhead. Which solution should be implemented?

Accepted Answer

Use Transit Gateway peering attachments between Transit Gateways in different regions.. Transit Gateway peering attachments enable transitive routing between Transit Gateways in different AWS regions, providing low-latency connectivity over the AWS global network without requiring VPN or Direct Connect. This solution minimizes operational overhead because AWS manages the peering connection and route propagation automatically, allowing VPCs attached to different Transit Gateways to communicate across regions.

Answer

Set up a VPN connection between Transit Gateways in different regions.

Answer

Use AWS Direct Connect to connect the Transit Gateways in different regions.

Answer

Create VPC peering connections between all VPCs in different regions.