SAP-C02 Design Solutions for Organizational Complexity Practice Test 21 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a service control policy (SCP) that denies creation of S3 buckets without encryption. A service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted buckets

Answer

Enable S3 default encryption in each account

Answer

Use S3 bucket policies to require encryption

Question 2

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

Accepted Answer

Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts. VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket

Answer

Create VPC endpoints in each account to connect to the central S3 bucket

Answer

Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group

Question 3

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

Accepted Answer

Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity. Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Answer

Apply a service control policy to allow cross-account access

Answer

Create an IAM user in the production account and share the credentials with the development team

Answer

Configure security group rules to allow access from the development account

Question 4

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 5

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account

Question 6

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

Accepted Answer

Delegated administrator for AWS services. Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Answer

AWS Control Tower

Answer

Cross-account IAM roles

Answer

AWS CloudTrail organization trail

Question 7

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID. An SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Answer

Create an EC2 launch template with the approved AMI and share it with all accounts

Answer

Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances

Answer

Use AWS Config rules in each account to detect non-compliant instances and send alerts

Question 8

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

Accepted Answer

Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Answer

Create VPC peering connections between all VPCs and use security groups for inspection

Answer

Configure a VPN between each VPC and a central virtual appliance

Answer

Use AWS Direct Connect to connect all VPCs to a common router

Question 9

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that is enabled for all accounts. AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Answer

Configure each account's CloudTrail to send logs to a central CloudWatch Logs group

Answer

Create a CloudTrail trail in each account and deliver logs to the same S3 bucket

Answer

Use S3 replication to copy logs from individual account buckets to a central bucket

Question 10

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Accepted Answer

Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager. AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Answer

Deploy VPC endpoints in each account for communication

Answer

Establish VPC peering connections between each account and the central networking account

Answer

Set up AWS Direct Connect between all accounts

Question 11

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Accepted Answer

Attach the SCP to the root organizational unit to apply it to all accounts. AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.

Answer

Create an IAM policy in each account that requires tags on role creation

Answer

Set up AWS Budgets to alert on untagged roles

Question 12

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Accepted Answer

Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization. AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in each account

Answer

Enable GuardDuty manually in each member account by logging into each account

Answer

Create a service control policy to force GuardDuty to be enabled

Question 13

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

Accepted Answer

An IAM policy must be attached to the role granting permissions to the S3 bucket. The IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Answer

A service control policy must allow Lambda to assume roles

Answer

The S3 bucket must have a resource-based policy allowing the Lambda function

Answer

The trust policy must specify the Lambda function name

Question 14

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Accepted Answer

The subnet's auto-assign public IP setting is disabled. The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Answer

The internet gateway is not attached to the VPC

Answer

The subnet needs a NAT gateway for internet access

Answer

The subnet's route table does not have a route to the internet gateway

Question 15

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

Accepted Answer

The IAM role name already exists in the account. The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Answer

The trust policy does not include the correct service principal for EC2

Answer

The template does not have the required IAM capabilities

Answer

The role does not have an instance profile