SAP-C02 Design Solutions for Organizational Complexity Practice Test 23 — 15 Questions

Question 1

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

Accepted Answer

Deny effect with ec2:* and rds:* as the actions.. Option D is correct because AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Answer

Deny effect with "*" as the action.

Answer

Deny effect with NotAction set to ec2:* and rds:*.

Answer

Allow effect with ec2:* and rds:* as the actions.

Question 2

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Accepted Answer

Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.. Option A is correct because CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Answer

Use a VPC endpoint and route logs through a central VPC.

Answer

Attach an SCP to allow CloudTrail to write to the central bucket.

Answer

Create an IAM role in each member account and allow the central account to assume it.

Question 3

A company has a multi-account AWS environment. They want to ensure that any new account created in the organization automatically gets a specific set of IAM roles and AWS Config rules deployed. Which solution requires the least manual effort?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to the organization.. AWS CloudFormation StackSets with automatic deployment to the organization is the correct solution because it allows you to define a set of AWS resources (IAM roles, Config rules) as a CloudFormation template and automatically deploy it to every account in the organization, including newly created accounts, without any manual intervention. StackSets can be configured to deploy to all accounts in the organization or specific OUs, and they automatically handle the deployment to new accounts as they join the organization.

Answer

Use AWS Organizations and attach a tag policy that requires the roles and rules.

Answer

Attach an SCP to the root OU that creates the roles and rules.

Answer

Use AWS Lambda to periodically scan for new accounts and deploy resources.

Question 4

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.. Option C is correct because AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Answer

Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

Answer

Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

Answer

Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

Question 5

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

Accepted Answer

Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.. Option B is correct because AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to centrally enforce that any API action is denied unless the request includes MFA. By using the `aws:MultiFactorAuthPresent` condition key set to `false`, the SCP effectively blocks all AWS actions (including console login) for any principal that has not authenticated with MFA. This ensures a blanket, unmodifiable guard across all member accounts, even preventing account administrators from bypassing the requirement.

Answer

Use AWS CloudTrail to detect console logins without MFA and send alerts.

Answer

Require each IAM user to have a virtual MFA device assigned.

Answer

Create an IAM group for users without MFA and deny them console access.

Question 6

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Accepted Answer

Create a private hosted zone in the central networking account.. Option A is correct because a private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Answer

Create a public hosted zone with the same name and configure DNSSEC.

Answer

Create a Route 53 Resolver outbound endpoint in each account.

Question 7

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Accepted Answer

Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.. Option B is correct because AWS IAM Identity Center can use AWS Managed Microsoft AD as its identity source, enabling seamless synchronization of users and groups from an existing on-premises Active Directory via a two-way forest trust. This eliminates the need for manual import and provides a managed, highly available directory service that integrates directly with IAM Identity Center for single sign-on across multiple AWS accounts.

Answer

Create an IAM Identity Center identity store and manually import users from Active Directory.

Answer

Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.

Answer

Configure AWS CloudTrail to log all sign-in events.

Question 8

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Accepted Answer

To ensure that only requests originating from accounts within the specified organization are allowed.. The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Answer

To restrict access to only the root user of the management account.

Answer

To enforce that all requests are made using HTTPS.

Answer

To allow access only from specific IP addresses within the organization.

Question 9

Refer to the exhibit. A security engineer ran this AWS CLI command to investigate who created a CloudTrail trail in January 2024. The command returned no results. However, the security team knows that a trail was created during that period. What is the most likely reason for the empty result?

Accepted Answer

The trail was created in a different region and the command did not specify a region.. The AWS CLI command `aws cloudtrail lookup-events` defaults to the region configured in the AWS CLI profile (e.g., `us-east-1`). If the CloudTrail trail was created in a different region, the command will return no results unless the `--region` parameter is explicitly specified. Since the security team knows the trail was created in January 2024, the most likely reason for the empty result is that the command did not target the correct region.

Answer

The start time is too far in the past and CloudTrail only retains events for 90 days.

Answer

The trail was created using the AWS Management Console, not the CLI.

Answer

The command syntax is incorrect; the --lookup-attributes parameter should be --attribute.

Question 10

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Accepted Answer

It denies all actions if the request is not made over HTTPS.. This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is wrong because it does not enforce MFA. Option C is wrong because it does not block specific services. Option D is wrong because it does not allow all actions; it denies unencrypted requests.

Answer

It denies all actions if the request does not include multi-factor authentication.

Answer

It denies all actions from IP addresses outside the corporate network.

Answer

It allows all actions as long as the request is made over HTTPS.

Question 11

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.. Option C is correct because a service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Answer

Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

Answer

Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

Question 12

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

Accepted Answer

Use AWS Control Tower account factory and AWS CloudFormation StackSets to deploy the VPC across all accounts.. Option C is correct because AWS Control Tower's Account Factory combined with AWS CloudFormation StackSets enables automated, centralized deployment of identical VPC configurations across all 50 accounts in the same Region. StackSets allow you to deploy a CloudFormation template to multiple accounts and Regions from a single administrator account, ensuring consistency without manual intervention.

Answer

Use AWS CloudFormation templates manually triggered in each account.

Answer

Create a VPC in one account and share it with other accounts using AWS Resource Access Manager (RAM).

Answer

Use AWS Organizations to create the VPC in each account via an SCP.

Question 13

A company uses a single AWS account for development and production workloads. To improve security and cost allocation, the company decides to separate environments into multiple accounts. What is the PRIMARY benefit of using multiple accounts?

Accepted Answer

Enabling centralized security controls and consolidated billing.. Separating environments into multiple AWS accounts provides a strong security boundary (via AWS Organizations SCPs) and enables consolidated billing with cost allocation tags. This allows centralized security controls (e.g., guardrails, IAM policies) across accounts while aggregating usage for volume discounts, which is the primary benefit for improving security and cost allocation.

Answer

Reducing overall compute costs by sharing reserved instances across environments.

Answer

Simplifying backup and disaster recovery procedures.

Answer

Decreasing network latency between development and production environments.

Question 14

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Accepted Answer

Centrally enforce policies using service control policies (SCPs).. Service control policies (SCPs) allow you to centrally manage permissions for all accounts in your AWS Organizations hierarchy. SCPs act as a guardrail, enabling you to define the maximum available permissions for IAM roles and users across member accounts without granting any permissions themselves. This ensures consistent enforcement of security and compliance policies across the entire organization.

Answer

Automatically create VPC peering connections between accounts.

Answer

Simplify cross-region replication for Amazon RDS databases.

Answer

Reduce the total cost of EC2 instances by aggregating usage across accounts.

Question 15

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. Option A is correct because S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.