SAP-C02 Design Solutions for Organizational Complexity Practice Test 21 — 15 Questions

Question 1

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.. The AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Answer

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Answer

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Answer

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Question 2

A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?

Accepted Answer

Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.. Enabling an organization trail in CloudTrail from the management account automatically applies to all accounts in the AWS Organization, delivering logs to a central S3 bucket with minimal per-account configuration. Using CloudWatch Logs with metric filters on that S3 bucket allows the security team to create a central CloudWatch dashboard that monitors API activity across all accounts, satisfying the requirement with the least operational overhead.

Answer

Use Amazon EventBridge to capture API calls from all accounts and route them to a central CloudWatch Logs group.

Answer

Enable CloudTrail in each account and configure the trail to send logs to a CloudWatch Logs group in that account. Then create a cross-account CloudWatch dashboard.

Answer

Use CloudWatch cross-account observability to aggregate logs from all accounts into a single monitoring account.

Question 3

A multinational corporation is using AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization have server-side encryption enabled, and any new bucket created without encryption must be automatically remediated. Which TWO steps should the team take to achieve this? (Choose two.)

Accepted Answer

Use a CloudWatch Events rule to trigger a Lambda function that enables encryption on any new bucket. Option C is correct because an Amazon EventBridge (CloudWatch Events) rule can match the CreateBucket API call and invoke a Lambda function that calls PutBucketEncryption to automatically remediate any new unencrypted bucket. Option D is correct because a Service Control Policy (SCP) applied at the organization or OU level can deny s3:PutBucketEncryption requests that lack the required encryption headers (e.g., x-amz-server-side-encryption), preventing buckets from being created or configured without SSE. Option A is not appropriate because IAM policies are identity-based and cannot enforce organization-wide guardrails across all accounts the way SCPs can. Option B is wrong because Trusted Advisor only reports findings and cannot automatically remediate. Option E is not selected because, while AWS Config with auto-remediation is a valid compliance approach, the question asks for the two steps that both enforce and automatically remediate, and the marked answers (EventBridge+Lambda and SCP) directly satisfy that requirement.

Answer

Use an IAM policy to deny s3:PutBucketEncryption without encryption settings

Answer

Use AWS Trusted Advisor to check bucket encryption and send alerts

Answer

Use AWS Config with a managed rule to detect non-compliant buckets and an auto-remediation action

Question 4

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the logging account. The logging account's S3 bucket policy allows CloudTrail to write logs from other accounts. The CloudTrail trail in each account is configured to deliver to the centralized bucket. However, logs from some accounts are not appearing. The security team has verified that the IAM permissions for CloudTrail are correct. What is the most likely reason for the missing logs?

Accepted Answer

The S3 bucket policy does not grant CloudTrail write access from the source accounts. The most likely reason for missing logs is that the S3 bucket policy in the logging account does not explicitly grant CloudTrail write access from the source accounts. Even though the bucket policy allows CloudTrail to write logs, it must include a principal that identifies the source account's CloudTrail service (e.g., `AWS:SourceAccount` or `AWS:SourceArn`) to authorize cross-account writes. Without this, CloudTrail from other accounts cannot deliver logs to the centralized bucket, regardless of correct IAM permissions in the source accounts.

Answer

CloudTrail cannot deliver logs to a bucket in a different AWS account

Answer

The S3 bucket policy does not include a condition for aws:SourceOrgID

Answer

The accounts need to enable VPC endpoints for S3 to communicate with the logging account

Question 5

A company uses AWS Organizations with multiple accounts. The network team wants to centrally manage Amazon VPC IP addresses using Amazon VPC IP Address Manager (IPAM). They have enabled IPAM in the management account and delegated an administrator account. However, the delegated administrator account cannot create IPAM pools. What is the most likely cause?

Accepted Answer

The delegated administrator account does not have the required IAM permissions to manage IPAM. When you delegate an administrator account for IPAM in AWS Organizations, that account still requires explicit IAM permissions to perform IPAM actions such as creating pools. The delegation only allows the account to manage IPAM resources on behalf of the organization; it does not automatically grant the necessary IAM permissions. Without a policy that allows actions like `ec2:CreateIpamPool`, the delegated administrator will receive an authorization error.

Answer

IPAM must be used only from the management account and cannot be delegated

Answer

IPAM is not supported in the AWS Region where the delegated administrator account operates

Answer

An SCP in the organization denies IPAM actions for all accounts

Question 6

A financial services company has an AWS Organizations structure with a dedicated network account that owns a Transit Gateway (TGW). Workload accounts each have a VPC attachment to the TGW. The security team requires that all traffic between workload VPCs be inspected by a central firewall appliance running in the network account's inspection VPC. The company wants to enforce this inspection automatically for any new VPC attachment without manually updating route tables in every workload account. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Configure the TGW as a shared resource using AWS Resource Access Manager (RAM), and in the network account create a TGW route table with a default route to the inspection VPC attachment, then associate all workload attachments with this route table and use TGW route table associations and propagations.. Centralizing inspection with a shared Transit Gateway and a single TGW route table that defaults to the inspection VPC attachment is the standard hub-and-spoke pattern. Because the TGW is shared via AWS RAM, workload accounts can attach VPCs without owning the TGW, and the network account controls routing policy in one place. New attachments only need association with the inspection route table, avoiding per-account route table changes.

Answer

Attach an internet gateway to each workload VPC and route inter-VPC traffic through the network account's NAT gateway for inspection.

Answer

Create a VPC peering connection between each workload VPC and the inspection VPC, and add a route in every workload VPC route table pointing to the peering connection for all non-local traffic.

Answer

Enable AWS PrivateLink endpoints in each workload VPC for the firewall appliance, and update each workload VPC's route table to send traffic to the endpoint.

Question 7

A financial services company operates a multi-account AWS environment managed by AWS Organizations. The security team requires that all IAM principals in member accounts be prevented from disabling AWS CloudTrail or modifying its configuration, even if an account administrator tries to do so. The company wants a centrally managed, scalable solution with minimal operational overhead. Which approach will meet these requirements?

Accepted Answer

Create an SCP in AWS Organizations that denies the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions, and attach it to all member accounts.. SCPs are the only AWS Organizations feature that can centrally deny actions across all member accounts, including actions by account administrators and the root user. Denying the specific CloudTrail mutating actions ensures that no principal can stop, delete, or update the trail. This is preventive, scalable, and requires no per-account resources, aligning with the minimal overhead requirement.

Answer

Use AWS Config conformance packs in each member account to detect changes to CloudTrail configuration and automatically remediate them with a custom Lambda function.

Answer

Enable AWS CloudTrail organization trail in the management account and configure an Amazon EventBridge rule to notify the security team when CloudTrail is stopped.

Answer

Attach an IAM permissions boundary to every IAM user and role in each member account that denies CloudTrail modification actions.

Question 8

A financial services company operates a multi-account AWS environment managed by AWS Organizations. A dedicated network account hosts a transit gateway that connects all VPCs. The security team requires that all traffic between workload VPCs be inspected by a central firewall appliance in the network account, without modifying the workload VPC route tables. Which solution should the solutions architect implement?

Accepted Answer

Enable AWS Transit Gateway appliance mode on the transit gateway attachment for the firewall VPC.. Transit Gateway appliance mode is specifically designed for scenarios where traffic must be inspected by a centralized appliance, such as a firewall, while preserving flow symmetry. It ensures that return traffic uses the same Availability Zone and attachment, allowing inspection without altering workload VPC route tables. This satisfies the central inspection and no-route-change requirements.

Answer

Deploy AWS Network Firewall in each workload VPC and manage policies centrally.

Answer

Use AWS PrivateLink to expose the firewall appliance to each workload VPC.

Answer

Create a VPC peering connection between each workload VPC and the firewall VPC.

Question 9

A financial services company uses AWS Organizations with a management account and 40 member accounts. The security team requires that all IAM principals in member accounts be denied access to any AWS service action unless the request originates from an approved IP range stored in a single centrally managed SCP. They also need the ability to add new approved IPs without modifying every account. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an SCP that denies all actions when the aws:SourceIp condition does not match a list of approved CIDRs, attach it to the organization root, and update the SCP whenever IPs change.. A service control policy attached at the organization root is inherited by every member account and can enforce an IP-based deny using the aws:SourceIp condition key with NotIpAddress. Because the policy lives in one place, adding an approved CIDR requires only a single SCP update, which immediately affects all accounts. This satisfies both the centralized enforcement and low-overhead update requirements without per-account resources.

Answer

Create an SCP in the management account that references a condition key populated by an AWS Lambda function that writes approved IPs to a Parameter Store value, then attach the SCP to the root of the organization.

Answer

Use AWS Firewall Manager to create a security group policy that blocks all outbound traffic from member accounts except to approved IP ranges.

Answer

Deploy an IAM permissions boundary in each member account that denies actions when aws:SourceIp is outside the approved range, and use AWS CloudFormation StackSets to update the boundary across accounts.

Question 10

A company has an AWS Organizations structure with a root, a Production OU, and a Sandbox OU. The security team must prevent any account in the Sandbox OU from creating VPCs with public subnets that automatically assign public IP addresses, but the Production OU must retain that ability. The company wants a centrally managed, drift-resistant control that applies automatically to future accounts added to the Sandbox OU. Which solution should a solutions architect recommend?

Accepted Answer

Attach an AWS Organizations service control policy to the Sandbox OU that denies ec2:ModifySubnetAttribute when the request includes MapPublicIpOnLaunch set to true, and deny ec2:CreateSubnet when the request includes MapPublicIpOnLaunch set to true.. Service control policies attached to an OU are inherited by every account in that OU, including accounts added later, and they act as preventive guardrails. Restricting the subnet attribute at the API level with conditions on ec2:CreateSubnet and ec2:ModifySubnetAttribute prevents public IP assignment in the Sandbox OU while leaving the Production OU unaffected. This satisfies the central management, automatic application, and drift-resistance requirements.

Answer

Create an AWS Config custom rule in the management account that evaluates subnets in all Sandbox accounts and triggers a remediation that disables MapPublicIpOnLaunch.

Answer

Attach an AWS Organizations service control policy to the Sandbox OU that denies the ec2:AssociateAddress and ec2:ModifySubnetAttribute actions for the MapPublicIpOnLaunch attribute.

Answer

Use AWS Control Tower to create a new OU for the Sandbox accounts and apply a preventive guardrail that denies public subnet creation, then move existing accounts into the new OU.

Question 11

A financial services company has an AWS Organizations structure with a management account, a dedicated network account, and 40 workload accounts. All workload accounts are attached to an organizational unit (OU) named Workloads. The company uses AWS Transit Gateway deployed in the network account, and each workload VPC has a Transit Gateway attachment. The security team wants to ensure that no workload account can create a VPC attachment to the Transit Gateway without explicit approval, and that only the network account can accept attachment requests. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Disable auto-accept on the Transit Gateway and share the Transit Gateway with the Workloads OU using AWS Resource Access Manager (RAM). Use an SCP to deny ec2:AcceptTransitGatewayVpcAttachment in all workload accounts.. The requirement is to allow workload accounts to request attachments but require the network account to approve them. Disabling auto-accept on the Transit Gateway and sharing it via AWS RAM with the Workloads OU enables requests. An SCP that denies the accept action in workload accounts ensures only the network account can accept, meeting the approval requirement with minimal overhead.

Answer

Create a new Transit Gateway in each workload account and peer them with the network account Transit Gateway. Use an SCP to deny ec2:CreateTransitGatewayPeeringAttachment in the Workloads OU.

Answer

Enable auto-accept for all Transit Gateway attachments and use an SCP on the Workloads OU that denies the ec2:CreateTransitGatewayVpcAttachment action.

Answer

Use AWS Resource Access Manager to share the Transit Gateway with each workload account individually. Configure the Transit Gateway to require manual acceptance and attach a resource-based policy to the Transit Gateway that allows only the network account to accept attachments.

Question 12

A company has a multi-account AWS environment with a central network account that hosts a transit gateway. Workload accounts are attached to the transit gateway via VPC attachments. The security team requires that all traffic between workload VPCs be inspected by a centralized firewall appliance in the network account. The firewall appliance is deployed in a separate VPC and is attached to the transit gateway. Which transit gateway configuration is required to ensure all inter-VPC traffic is routed through the firewall?

Accepted Answer

Create a transit gateway route table for the workload attachments that has a default route pointing to the firewall attachment, and associate the workload VPC attachments with this route table.. Transit gateway route tables control routing for attachments associated with them. To inspect inter-VPC traffic, the workload VPC attachments must be associated with a route table that sends all traffic (via a default route) to the firewall attachment. The firewall then inspects and forwards traffic to the destination VPC, which requires the firewall's route table to have routes back to the workload VPCs. This centralized inspection pattern is common in hub-and-spoke architectures.

Answer

Enable appliance mode on the transit gateway attachment for the firewall VPC.

Answer

Create a transit gateway route table for the firewall attachment that has a default route pointing to the workload attachments, and associate the firewall attachment with this route table.

Answer

Associate all workload VPC attachments with the default transit gateway route table and add a static route for each workload VPC CIDR pointing to the firewall attachment.

Question 13

A financial services company uses AWS Organizations with 60 accounts organized into separate OUs for Production, Non-Production, and Sandbox. The security team needs to prevent any principal in the Non-Production OU from disabling AWS CloudTrail or deleting the organization trail, while still allowing developers to create and manage their own trails for application-level auditing. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Attach an SCP to the Non-Production OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail on the organization trail ARN, while allowing other CloudTrail actions.. Service control policies are the only AWS Organizations mechanism that centrally and preventively restricts what principals in member accounts can do, regardless of their IAM permissions. Scoping the deny to the organization trail ARN preserves the ability of developers to manage their own trails, which satisfies both the security and the developer-autonomy requirements without per-principal maintenance.

Answer

Create an IAM permissions boundary in each Non-Production account that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, and attach it to all IAM roles.

Answer

Use AWS CloudTrail Lake in the management account to ingest events from all member accounts, and restrict access to the event data store with a resource-based policy.

Answer

Enable AWS Config in all Non-Production accounts with a managed rule that detects when CloudTrail logging is stopped, and use an AWS Lambda function to re-enable logging automatically.

Question 14

A company has an AWS Organizations structure with a root, several OUs, and 200 member accounts. The security team wants all member accounts to automatically receive a new IAM password policy that enforces a minimum length of 16 characters and prevents password reuse. They also need to ensure the policy cannot be altered or deleted by account administrators. What is the MOST operationally efficient way to meet these requirements?

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy an AWS::IAM::AccountPasswordPolicy resource to all accounts in the organization.. CloudFormation StackSets with service-managed permissions is the only option that automatically deploys and maintains the IAM password policy across all accounts in an organization, including future accounts. It uses a single template and central administration, meeting both the automation and the prevention-of-local-change requirements when combined with appropriate permissions.

Answer

Create an IAM password policy in the management account and use AWS Resource Access Manager to share it with all member accounts.

Answer

Create a service control policy (SCP) that denies iam:UpdateAccountPasswordPolicy and attach it to the root, then manually set the password policy in each account.

Answer

Create an IAM policy in the management account that enforces the password requirements and attach it to a role that is assumed by all member accounts.

Question 15

A company is migrating its on-premises data center to AWS. The company has a hybrid network with AWS Direct Connect and multiple VPCs in different AWS Regions. The security team requires that all traffic between on-premises and AWS, and between VPCs, be inspected by a central next-generation firewall (NGFW) appliance that supports advanced threat detection. The NGFW must scale automatically to handle traffic spikes. Which solution should the solutions architect recommend?

Accepted Answer

Deploy a fleet of EC2 instances running the NGFW software in a central VPC, behind a Network Load Balancer, and use AWS Transit Gateway with appliance mode.. A fleet of EC2 instances running the NGFW behind a Network Load Balancer, combined with Transit Gateway appliance mode, provides a scalable and central inspection point. The NGFW delivers advanced threat detection, the load balancer and Auto Scaling handle spikes, and appliance mode ensures traffic symmetry for both on-premises and inter-VPC flows.

Answer

Deploy the NGFW as a Gateway Load Balancer endpoint service and associate it with Transit Gateway.

Answer

Use AWS Transit Gateway with a Transit Gateway Connect attachment to integrate with the on-premises NGFW.

Answer

Deploy AWS Network Firewall in a central inspection VPC and use AWS Transit Gateway to route all traffic through it.