SAP-C02 Design Solutions for Organizational Complexity Practice Test 21 — 15 Questions

Question 1

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

Accepted Answer

Delegated administrator for AWS services. Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Answer

AWS Control Tower

Answer

Cross-account IAM roles

Answer

AWS CloudTrail organization trail

Question 2

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID. Option D is correct because an SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Answer

Create an EC2 launch template with the approved AMI and share it with all accounts

Answer

Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances

Answer

Use AWS Config rules in each account to detect non-compliant instances and send alerts

Question 3

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

Accepted Answer

Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. Option C is correct because AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Answer

Create VPC peering connections between all VPCs and use security groups for inspection

Answer

Configure a VPN between each VPC and a central virtual appliance

Answer

Use AWS Direct Connect to connect all VPCs to a common router

Question 4

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that is enabled for all accounts. Option C is correct because AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Answer

Configure each account's CloudTrail to send logs to a central CloudWatch Logs group

Answer

Create a CloudTrail trail in each account and deliver logs to the same S3 bucket

Answer

Use S3 replication to copy logs from individual account buckets to a central bucket

Question 5

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Accepted Answer

Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager. Option B is correct because AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Answer

Deploy VPC endpoints in each account for communication

Answer

Establish VPC peering connections between each account and the central networking account

Answer

Set up AWS Direct Connect between all accounts

Question 6

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Accepted Answer

Attach the SCP to the root organizational unit to apply it to all accounts. Option C is correct because AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.

Answer

Create an IAM policy in each account that requires tags on role creation

Answer

Set up AWS Budgets to alert on untagged roles

Question 7

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Accepted Answer

Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization. Option D is correct because AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in each account

Answer

Enable GuardDuty manually in each member account by logging into each account

Answer

Create a service control policy to force GuardDuty to be enabled

Question 8

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

Accepted Answer

An IAM policy must be attached to the role granting permissions to the S3 bucket. Option A is correct because the IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Answer

A service control policy must allow Lambda to assume roles

Answer

The S3 bucket must have a resource-based policy allowing the Lambda function

Answer

The trust policy must specify the Lambda function name

Question 9

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Accepted Answer

The subnet's auto-assign public IP setting is disabled. Option C is correct because MapPublicIpOnLaunch is false, so instances launched in the subnet are not assigned public IP addresses automatically. Without a public IP, they cannot communicate with the internet via the internet gateway. Option A is wrong because the route to the internet gateway exists. Option B is wrong because the internet gateway is attached. Option D is wrong because NAT gateway is not required if the subnet had public IPs.

Answer

The internet gateway is not attached to the VPC

Answer

The subnet needs a NAT gateway for internet access

Answer

The subnet's route table does not have a route to the internet gateway

Question 10

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

Accepted Answer

The IAM role name already exists in the account. The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Answer

The trust policy does not include the correct service principal for EC2

Answer

The template does not have the required IAM capabilities

Answer

The role does not have an instance profile

Question 11

A multinational company is adopting AWS Organizations to manage multiple accounts across business units. The security team requires that specific IAM roles be automatically deployed to all existing and future member accounts. Which solution should the company use?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment enabled in the organization.. AWS CloudFormation StackSets with automatic deployment enabled allows you to deploy IAM roles across all accounts in an AWS Organization, including future accounts, by specifying the organization root or OUs as targets. This ensures consistent role creation without manual intervention, as StackSets automatically provisions stacks in new accounts as they join the organization.

Answer

Use AWS Config rules to enforce the role creation in each account.

Answer

Use AWS Service Catalog to create a portfolio with the IAM role product and share it with all accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create the role in each account.

Question 12

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.. Option B is correct because a service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Answer

Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.

Answer

Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.

Question 13

A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?

Accepted Answer

AWS CloudTrail. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.

Answer

Amazon S3 cross-region replication

Answer

Amazon Kinesis Data Firehose

Answer

AWS Config

Question 14

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

Accepted Answer

Use AWS Systems Manager Explorer with multi-account management.. AWS Systems Manager Explorer provides a single-pane-of-glass view across multiple AWS accounts and Regions, allowing the operations team to view and modify EC2 Auto Scaling policies centrally. It integrates with Systems Manager Automation runbooks to execute changes, such as updating scaling policies, across all accounts managed via AWS Organizations.

Answer

Use AWS CloudFormation StackSets to deploy the Auto Scaling groups consistently.

Answer

Use AWS Config rules to enforce desired scaling policies.

Answer

Use Amazon CloudWatch cross-account dashboards.

Question 15

A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?

Accepted Answer

Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. A service control policy (SCP) can deny actions that disable CloudTrail or delete logs. Option A is wrong because IAM permissions only apply within an account. Option B is wrong because CloudTrail is not a resource that can be protected by a resource-based policy in this context. Option D is wrong because AWS Config is detective.

Answer

Use AWS Config rules to detect and remediate any changes to CloudTrail configurations.

Answer

Create an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all IAM users.

Answer

Apply a resource-based policy to the CloudTrail trail that denies these actions.