SAP-C02 Design Solutions for Organizational Complexity Practice Test 22 — 15 Questions

Question 1

A healthcare company runs a multi-account AWS environment under AWS Organizations. A central networking account hosts a transit gateway, and workload VPCs in other accounts attach to it. The security team must ensure that traffic between the production and development VPCs is blocked, while both can reach a shared services VPC. They also need to log all rejected traffic for compliance. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate transit gateway route tables for production and development attachments, and do not associate the production attachment with the development route table.. Isolating production and development requires separate transit gateway route tables whose associations and propagations prevent cross-routing, while both route tables still include the shared services attachment. Compliance logging of rejected traffic is achieved with VPC Flow Logs using a REJECT filter delivered to a central S3 bucket. Together these provide segmentation and an audit trail without per-account network ACL sprawl.

Answer

Apply a network ACL to the transit gateway attachments that denies traffic between the production and development CIDR ranges.

Answer

Enable transit gateway attachment-level logging and configure a CloudWatch Logs log group to capture rejected packets.

Answer

Use AWS Resource Access Manager to share the transit gateway with only the shared services account and deny sharing with production and development accounts.

Question 2

A financial services company uses AWS Organizations with a dedicated network account that hosts a Transit Gateway. Workload accounts are attached to the Transit Gateway, but the network team wants to prevent workload accounts from creating their own Transit Gateway attachments and instead only allow them to associate with pre-approved Transit Gateway route tables. Which combination of actions should the network team take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway from the network account, and apply an SCP to the workload OUs that denies ec2:CreateTransitGatewayVpcAttachment and allows only ec2:AssociateTransitGatewayRouteTable.. Sharing the Transit Gateway via AWS RAM allows workload accounts to attach VPCs without needing their own Transit Gateway. An SCP applied at the OU level centrally denies the creation of new attachments while permitting association with pre-approved route tables. This combination enforces the network team's policy with minimal per-account effort and maintains a hub-and-spoke topology.

Answer

Use AWS Resource Access Manager to share the Transit Gateway, and attach an IAM policy to each workload account's administrator role that denies ec2:CreateTransitGatewayVpcAttachment.

Answer

Create a new Transit Gateway in each workload account and use AWS Resource Access Manager to share route tables from the network account's Transit Gateway.

Answer

Create a VPC peering connection between the network account and each workload VPC, and use an SCP to deny ec2:CreateTransitGatewayVpcAttachment in the workload OUs.

Question 3

A global enterprise uses AWS Organizations with a single management account and multiple OUs for production, development, and sandbox. The security team wants to prevent any account in the sandbox OU from creating resources outside of the us-east-1 and eu-west-1 Regions, while allowing all actions in those two Regions. The production and development OUs must remain unaffected. Which action should the security team take?

Accepted Answer

Attach a service control policy to the sandbox OU that denies all actions with a condition of StringNotEquals on aws:RequestedRegion for us-east-1 and eu-west-1.. Service control policies are the organizational tool for restricting what accounts can do, and attaching one to the sandbox OU scopes the restriction to only those accounts. A Deny with a StringNotEquals condition on aws:RequestedRegion blocks actions in any Region other than the two allowed, while leaving production and development OUs untouched. This is precise and low overhead.

Answer

Enable AWS Control Tower and create a guardrail that restricts Regions for the sandbox OU.

Answer

Attach a service control policy to the organization root that denies actions outside the two Regions, and add an exception for the production and development OUs.

Answer

Attach an IAM permissions boundary to every IAM user and role in the sandbox accounts that denies actions outside the two Regions.

Question 4

A retail company has 25 AWS accounts in AWS Organizations. The finance team wants a consolidated monthly view of costs across all accounts, including accounts that are not yet part of the organization. They also want to enforce that no account can leave the organization without approval. Which combination of features should a solutions architect use?

Accepted Answer

Enable AWS Cost Explorer with the organization view and AWS Cost Categories in the management account, and enable all features in AWS Organizations so that member accounts cannot leave without management account approval.. Enabling all features in AWS Organizations means member accounts cannot leave without management account approval, which provides the required control. Cost Explorer's organization view gives finance a consolidated cost picture across member accounts, and Cost Categories can organize spend. Together these features meet the reporting and governance requirements without custom tooling.

Answer

Enable AWS Cost Explorer in each account and share reports manually with the finance team, and use IAM policies to prevent accounts from leaving.

Answer

Use AWS Organizations consolidated billing and enable all features, and rely on the management account's billing console for the consolidated view.

Answer

Enable AWS Cost Explorer and AWS Budgets in the management account, and use an AWS Organizations service control policy to deny the organizations:LeaveOrganization action.

Question 5

A company uses AWS Organizations with a management account and 200 member accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central audit account. They want to minimize the number of IAM roles that must be created and maintained in each member account. They also want to ensure that when a new account is created via AWS Control Tower, the required roles are automatically provisioned. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS Control Tower Account Factory to create accounts, and use the Account Factory Customization (AFC) to deploy a baseline that includes the required IAM roles.. The requirements are to centrally manage IAM roles across many accounts and automatically provision them for new accounts. CloudFormation StackSets with service-managed permissions deploys roles across the organization and automatically to new accounts. Control Tower Account Factory Customization can apply a baseline with the roles during account creation, ensuring new accounts are configured correctly.

Answer

Use AWS IAM Identity Center (successor to AWS Single Sign-On) to assign permission sets that grant cross-account access, eliminating the need for IAM roles in member accounts.

Answer

Create a single IAM role in each member account using a script that runs on a schedule, and store the role ARN in AWS Systems Manager Parameter Store.

Answer

Create an IAM role in the management account and use AWS STS AssumeRole to access member accounts, avoiding the need for roles in member accounts.

Question 6

A company has a single AWS account and wants to give a team of developers access to a specific S3 bucket. The developers are external contractors and do not have IAM users in the company's account. The company wants to grant them access without creating IAM users or sharing long-term credentials. Which AWS service should they use?

Accepted Answer

AWS Identity and Access Management (IAM) with a cross-account role that trusts the contractors' AWS account.. Cross-account IAM roles allow external AWS accounts to assume a role and obtain temporary credentials, avoiding the need to create IAM users or share long-term credentials. The role's trust policy specifies the contractors' account, and the permissions policy scopes access to the specific S3 bucket. This is the standard, secure way to grant cross-account access.

Answer

Amazon Cognito identity pools to authenticate the contractors and grant access to the S3 bucket.

Answer

S3 bucket policies that grant public access to the bucket, restricted by IP address.

Answer

AWS Single Sign-On (SSO) with an external identity provider to federate access to the S3 bucket.

Question 7

A financial services company uses AWS Organizations with a central Network account that owns a transit gateway and a shared services VPC. Each business unit has its own account and VPC, and all inter-VPC traffic must traverse the transit gateway. The security team requires that traffic between business units be inspected by a centralized firewall appliance in the Network account, and that business units cannot attach their VPCs directly to the transit gateway. Which combination of AWS features should a solutions architect implement?

Accepted Answer

Create a transit gateway in the Network account, share it with business unit accounts using AWS Resource Access Manager, and use a transit gateway route table with a blackhole route plus a separate inspection VPC attachment for the firewall appliance.. AWS Resource Access Manager allows the Network account to share a transit gateway with business unit accounts so they can attach VPCs without owning the gateway. Using separate transit gateway route tables, including a blackhole route and an inspection VPC attachment, forces inter-VPC traffic through the centralized firewall appliance. This satisfies both the central inspection mandate and the restriction on direct attachment.

Answer

Create a transit gateway in the Network account, share it with business unit accounts using AWS Resource Access Manager, and instruct each business unit to attach its VPC to the default transit gateway route table.

Answer

Create a transit gateway in the Network account, share it with AWS Resource Access Manager only to the Network account, and have each business unit create a VPC peering connection to the shared services VPC.

Answer

Create a transit gateway in each business unit account, peer the transit gateways together, and route all traffic through the Network account using static routes.

Question 8

A company has multiple AWS accounts in an organization. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They also want to allow programmatic access without MFA for service accounts. Which solution meets these requirements?

Accepted Answer

Create an SCP that denies console sign-in unless MFA is used, by denying the aws:ConsoleLogin action when aws:MultiFactorAuthPresent is false, and attach it to all accounts.. To enforce MFA for console access while allowing programmatic access without MFA, an SCP can deny the aws:ConsoleLogin action when the aws:MultiFactorAuthPresent condition is false. This applies to all IAM users in the accounts where the SCP is attached. API calls are not affected because they do not use the ConsoleLogin action. This is a common pattern for enforcing MFA at the organization level.

Answer

Create an SCP that denies all actions unless the principal has authenticated with MFA, and attach it to all accounts.

Answer

Create an IAM policy that denies console access unless MFA is present, and attach it to all IAM users. Allow programmatic access by not including the MFA condition for API calls.

Answer

Use an SCP that denies all actions except when aws:MultiFactorAuthPresent is true, but add a condition to allow actions when the principal is a service account with a specific tag.

Question 9

A company has a multi-account AWS environment with a central networking account that hosts a Transit Gateway. They want to connect their on-premises data center to all VPCs in the organization using a single AWS Site-to-Site VPN. The VPN is terminated on a virtual private gateway (VGW) in the networking account's VPC. The Transit Gateway is attached to the VPC. However, after configuration, resources in the workload VPCs cannot reach on-premises servers. What is the most likely cause?

Accepted Answer

The Transit Gateway route table does not have a route to the VPN connection, and the VPC route tables do not have routes to the Transit Gateway for on-premises CIDR.. When using a Transit Gateway with a VPN terminated on a VGW in a VPC, traffic from other VPCs to on-premises must be routed through the Transit Gateway. The workload VPC route tables need a route to the Transit Gateway for the on-premises CIDR. The Transit Gateway route table must have a route to the VPC attachment (or the VPN attachment) for the on-premises CIDR. Without these routes, traffic cannot reach on-premises.

Answer

The virtual private gateway (VGW) does not support Equal-Cost Multi-Path (ECMP) routing.

Answer

The on-premises customer gateway is not configured with the correct BGP ASN.

Answer

The VPN connection is not associated with the Transit Gateway.

Question 10

A financial services company uses AWS Organizations with a central networking account and 50 workload accounts. They need to provide each workload account with a dedicated VPC that has connectivity to a shared services VPC in the networking account. The solution must minimize administrative overhead and allow the workload accounts to manage their own VPCs. Which approach meets these requirements?

Accepted Answer

Create a VPC in the networking account and share subnets with each workload account using AWS Resource Access Manager. Workload accounts launch resources into the shared subnets.. Sharing subnets from a central VPC via AWS Resource Access Manager allows the networking account to maintain control over the VPC while giving workload accounts the ability to deploy resources into shared subnets. This reduces overhead, provides connectivity, and meets the requirement for workload accounts to manage their own resources without building separate VPCs.

Answer

Use AWS PrivateLink to create interface VPC endpoints in each workload account for the shared services. Workload accounts create their own VPCs and connect to the endpoints.

Answer

Use AWS Transit Gateway in the networking account and create a peering connection from each workload VPC to the Transit Gateway. Attach each workload VPC to the Transit Gateway.

Answer

Create a VPC in each workload account and use VPC peering to connect each workload VPC to the shared services VPC. Manage all peering connections from the networking account.

Question 11

An enterprise uses AWS Organizations with a centralized log archive account. A new compliance rule requires that all Amazon S3 access logs and AWS CloudTrail logs from every account be retained for seven years and that no member account administrator, including the log archive account administrator, be able to delete or alter them. Which combination of controls should the solutions architect implement?

Accepted Answer

Enable S3 Object Lock in compliance mode on the central log bucket, set a seven-year retention period, and use an SCP to deny s3:PutBucketObjectLockConfiguration and s3:PutObjectRetention in member accounts.. S3 Object Lock in compliance mode is the only S3 feature that prevents deletion or retention reduction by any user, including the account root, for the specified period. Setting a seven-year retention on the central bucket enforces the compliance rule, and an SCP prevents member accounts from weakening the lock configuration. This delivers immutable, centralized log retention.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except a break-glass role, and store the role credentials in AWS Secrets Manager.

Answer

Enable S3 Versioning and MFA delete on the central log bucket, and require MFA for all delete operations through an SCP.

Answer

Use AWS Backup to create a vault lock policy with a seven-year retention and copy all log data into the backup vault daily.

Question 12

A healthcare company operates a landing zone with a central network account that hosts an AWS Transit Gateway. Each of 40 workload accounts has a VPC attached to the transit gateway, and a shared services VPC hosts Active Directory domain controllers. The company wants workload VPCs to reach the shared services VPC but must prevent any workload VPC from reaching another workload VPC. The network team wants to add new workload accounts without modifying existing route tables. What should a solutions architect implement?

Accepted Answer

Create a separate transit gateway route table for the shared services attachment and associate each workload VPC attachment with a workload route table that propagates only the shared services route.. Transit gateway route tables provide network-layer segmentation by controlling which attachments can learn which routes. Associating all workload attachments with a dedicated workload route table that only propagates the shared services route ensures workload VPCs cannot reach each other, and new accounts inherit the same isolation simply by associating with that route table, eliminating ongoing route table edits.

Answer

Deploy a Network Firewall in the central network account and create stateful rules that deny traffic between workload CIDR ranges while allowing traffic to the shared services CIDR.

Answer

Enable transit gateway attachment-level route propagation for all workload VPCs and use security groups in each workload VPC to block traffic from other workload CIDR ranges.

Answer

Use AWS Resource Access Manager to share the transit gateway with all workload accounts and instruct each account to create a blackhole route for the other workload CIDRs in its own VPC route tables.

Question 13

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to centrally manage IAM roles that grant cross-account access to a central data lake in Amazon S3. They need to ensure that only roles created by the security team can access the data lake, and that any changes to these roles are automatically propagated. Which solution meets these requirements?

Accepted Answer

Use AWS CloudFormation StackSets to deploy IAM roles in member accounts with a trust policy that allows only the security account to assume them, and use an SCP to deny iam:PassRole except for a specific role in the security account.. CloudFormation StackSets provide centralized deployment of IAM roles with a trust policy that limits assumption to the security account. An SCP that denies iam:PassRole except for a designated role in the security account prevents member accounts from granting that role to other entities, ensuring only security-team-created roles can access the data lake. This combination enforces both creation and usage controls.

Answer

Use AWS Organizations to create a service control policy that allows only the security account to assume roles in member accounts, and use AWS CloudFormation StackSets to deploy the roles with a condition that the role name starts with a specific prefix.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles with a trust policy that allows the security account to assume them, and use a service control policy to deny iam:CreateRole in all member accounts.

Answer

Use AWS IAM Identity Center to create permission sets that grant access to the data lake, and assign them to users in the security account.

Question 14

A global logistics company uses AWS Organizations with a central Shared Services account that hosts a multi-account AWS Transit Gateway and a central VPC. Workload accounts in different OUs must reach on-premises networks through a VPN attached to the central VPC, and the security team wants to inspect traffic between workload VPCs. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

In the Shared Services account, create a dedicated inspection VPC with a Gateway Load Balancer endpoint, and route inter-VPC traffic through it using Transit Gateway route tables.. Sharing the central Transit Gateway with AWS RAM lets workload accounts attach their VPCs without building separate gateways. A central inspection VPC with a Gateway Load Balancer endpoint, combined with Transit Gateway route table associations and propagations, forces inter-VPC traffic through security appliances while preserving on-premises connectivity through the VPN attached to the central VPC.

Answer

Attach the VPN to the Transit Gateway directly and enable equal-cost multi-path routing across all attachments.

Answer

Create a separate Transit Gateway in each workload account and peer them to the central Transit Gateway in a hub-and-spoke topology.

Answer

Use VPC peering between each workload VPC and the central VPC, and enable route propagation to the Transit Gateway.

Question 15

A company has a multi-account AWS environment with AWS Organizations. The company wants to ensure that all new Amazon EC2 instances are launched with IMDSv2 enforced. Which solution provides the simplest and most effective enforcement across all accounts?

Accepted Answer

Create an SCP that denies ec2:RunInstances unless the request includes the metadata-options parameter with HttpTokens set to required.. A service control policy (SCP) that denies ec2:RunInstances without the required metadata-options parameter provides preventive, organization-wide enforcement. It applies to all accounts and principals (except the management account) and requires no per-account configuration, making it the simplest and most effective solution.

Answer

Enable EC2 Instance Metadata Service default enforcement in each account's EC2 console settings.

Answer

Use AWS Config rules to detect EC2 instances that do not enforce IMDSv2 and automatically remediate them with AWS Systems Manager Automation.

Answer

Create an IAM policy that denies ec2:RunInstances unless the request includes the metadata-options parameter with HttpTokens set to required, and attach it to all IAM roles.