SAP-C02 Design Solutions for Organizational Complexity Practice Test 22 — 15 Questions

Question 1

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct service because it acts as a central hub that can route traffic between multiple VPCs across different accounts, and it supports route tables that can force all inter-VPC traffic through a dedicated inspection VPC (e.g., using a blackhole route or a network appliance). This enables transitive routing without requiring full mesh peering, and it integrates with AWS Resource Access Manager (RAM) for cross-account sharing.

Answer

AWS Direct Connect gateway

Answer

VPC peering with full mesh connectivity

Answer

Elastic Load Balancer

Question 2

A company has a management account in AWS Organizations and wants to share a central Amazon VPC subnet with multiple member accounts for a shared services VPC. Which AWS service should be used to share the subnet?

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is the correct service because it enables you to share a central VPC subnet from a management account with multiple member accounts in AWS Organizations without requiring VPC peering or transit gateways. With RAM, you create a resource share that includes the subnet and specify the member accounts or organizational units (OUs) to grant them access, allowing those accounts to launch resources directly into the shared subnet while maintaining centralized network management.

Answer

VPC peering connection

Answer

AWS PrivateLink

Answer

Service control policy

Question 3

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

Accepted Answer

Use service control policies with aws:SourceIp and aws:SourceVpc conditions.. Service control policies (SCPs) in AWS Organizations can enforce a data perimeter by restricting access based on network origin using the `aws:SourceIp` and `aws:SourceVpc` condition keys. This approach works across all accounts in the organization, ensuring that only requests from approved networks (e.g., specific IP ranges or VPCs) are allowed, regardless of individual account configurations.

Answer

Use S3 bucket policies with aws:SourceIp condition.

Answer

Use AWS Config rules to detect and alert on non-compliant access.

Answer

Use network ACLs in each VPC.

Question 4

A company wants to centrally manage backups for Amazon EBS volumes across multiple AWS accounts. They need a solution that can automatically back up volumes based on tags, retain backups according to a policy, and send notifications on failures. Which AWS service should they use?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based backup solution for Amazon EBS volumes across multiple AWS accounts. It supports tag-based backup policies, retention rules, and integrates with Amazon CloudWatch Events and Amazon SNS to send notifications on failures, meeting all the stated requirements.

Answer

AWS CloudFormation StackSets

Answer

Amazon RDS automated backups

Answer

Amazon S3 lifecycle policies

Question 5

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.. Option C is correct because a service control policy (SCP) can be applied at the organizational unit (OU) or account level to deny all console access unless the `aws:MultiFactorAuthPresent` condition key is `true`. This enforces MFA usage across all member accounts centrally, without requiring per-account IAM policy changes. SCPs are the recommended mechanism for guardrails in AWS Organizations because they cannot be overridden by account administrators.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Enable AWS CloudTrail to log console access without MFA.

Answer

Use AWS Single Sign-On (SSO) with MFA enabled for all users.

Question 6

A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and bandwidth. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across different AWS accounts and route traffic to the Direct Connect virtual interface, enabling a scalable hub-and-spoke architecture for hybrid connectivity.

Answer

Amazon Route 53 Resolver

Answer

VPC peering

Answer

AWS Client VPN

Question 7

A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which THREE steps are required to achieve this?

Accepted Answer

Create a new CloudTrail trail in the management account with organization trail enabled.. Option C is correct because enabling organization trail in the management account allows CloudTrail to automatically create a trail that logs events for all accounts in the AWS Organization, eliminating the need to manually enable CloudTrail in each member account. This is the only way to centrally collect CloudTrail logs from all accounts without individual account configuration.

Answer

Create an AWS Config rule to monitor CloudTrail configuration.

Answer

Apply a service control policy (SCP) to enforce CloudTrail logging.

Question 8

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

Accepted Answer

Denies launching instances that are not t3.micro or t3.small for IAM users and roles, but not root.. The SCP uses a Deny effect with a condition that denies any EC2:RunInstances action unless the instance type is t3.micro or t3.small. However, SCPs do not affect the root user (the management account's root user) because SCPs cannot restrict the root user in the management account. Therefore, the policy denies launching non-compliant instance types for IAM users and roles, but not for the root user.

Answer

Allows only t3.micro and t3.small instances to be launched.

Answer

Has no effect because SCPs cannot deny actions.

Answer

Denies launching any instance except t3.micro and t3.small for all users including root.

Question 9

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

Accepted Answer

The Suspended account cannot be used until it is reactivated.. The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Answer

The Suspended account was invited to the organization.

Answer

The Production account is the management account.

Answer

The Management account was created directly.

Question 10

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

Accepted Answer

No, because the source identity does not match.. The assumption fails because the trust policy on AuditRole includes a `sts:SourceIdentity` condition that requires the source identity to match a specific value (e.g., 'auditor'), but the session is launched with source identity 'admin'. Since the condition is not satisfied, AWS STS denies the AssumeRole API call, even though the principal (the Admin role in account 222222222222) is allowed by the `Principal` element. The `sts:SourceIdentity` condition key is evaluated at request time and must match exactly for the policy to grant access.

Answer

Yes, because the role in account 222222222222 is allowed by the principal.

Answer

No, because cross-account role assumption is not allowed.

Answer

Yes, because the source identity condition is optional.

Question 11

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Accepted Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.. Option D is correct because it uses a service control policy (SCP) to deny the s3:PutBucketPublicAccessBlock action unless a specific tag is present. This enforces the desired AWS Config rule indirectly by preventing any action that would disable or bypass the public access block, and it applies automatically to all new accounts in the organization with minimal overhead—no per-account deployment or configuration is needed.

Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Question 12

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

Accepted Answer

Use attribute-based access control (ABAC) with IAM Identity Center and session tags from Active Directory.. Option C is correct because it uses attribute-based access control (ABAC) with IAM Identity Center, which allows permissions to be dynamically granted based on user attributes (e.g., job function) passed as session tags from Active Directory. This approach scales seamlessly as users and accounts grow, since policies reference tags rather than individual users or groups, and it centralizes identity management without requiring per-account role updates.

Answer

Create a permission set in IAM Identity Center for each job function and assign to appropriate groups.

Answer

Use AWS Organizations to attach SCPs that grant permissions based on user tags.

Answer

Use IAM roles directly in each account and manage trust policies centrally.

Question 13

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

Accepted Answer

Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.. Option D is correct because Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.

Answer

Use an SCP to require that CloudTrail is enabled.

Answer

Use IAM policies in each account to deny the same actions.

Answer

Use AWS Config rules to detect and remediate changes.

Question 14

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Option B is correct because using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 15

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

Accepted Answer

Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.. Option B is correct because AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Answer

Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.

Answer

Use AWS Cost Explorer to filter by resource tags after they are manually applied.