SAP-C02 Design Solutions for Organizational Complexity Practice Test 23 — 15 Questions

Question 1

A software company has an AWS Organizations structure with separate OUs for development, staging, and production. The finance team wants to allocate AWS costs by OU and by project, and needs the ability to roll up costs across accounts in an OU. A solutions architect must enable this with minimal operational overhead. What should the architect do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate the cost allocation tags for Project and OU in the management account's Billing and Cost Management console, and use AWS Cost Explorer grouped by these tags.. AWS cost allocation tags must be activated in the management account to appear in billing reports, after which Cost Explorer can group costs by tag. Combined with the native OU dimension in Organizations, this delivers project and OU rollups with minimal effort. Cost and Usage Reports per OU, Budgets, and Trusted Advisor do not provide the required allocation and rollup.

Answer

Enable AWS Budgets in each member account with a filter on the Project tag and aggregate the budget alerts in the management account.

Answer

Create a separate AWS Cost and Usage Report for each OU and store them in the log archive account for manual aggregation.

Answer

Use AWS Trusted Advisor in the management account to generate cost optimization reports grouped by OU and project tag.

Question 2

A financial services company uses AWS Organizations with 200 accounts. The security team must ensure that a newly created Amazon S3 bucket in any account cannot be made public, even by an account administrator. They want a central, scalable solution that does not require per-account maintenance. Which solution meets these requirements?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketAcl and s3:PutBucketPolicy unless the request includes a condition that ensures the bucket is not public, and attach it to all accounts.. A service control policy (SCP) attached to all accounts in AWS Organizations provides centralized, preventive control. By denying actions that could make an S3 bucket public unless specific conditions are met, the SCP ensures that even account administrators cannot override the restriction. This approach is scalable and does not require per-account maintenance, meeting the requirements.

Answer

Enable S3 Block Public Access at the organization level using AWS Organizations and apply the policy to all accounts.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions that would allow public access, and attach it to all accounts.

Answer

Use AWS Config with a custom rule that detects public S3 buckets and triggers an AWS Lambda function to remediate by applying a bucket policy that denies public access.

Question 3

A company has a multi-account AWS environment with AWS Organizations. The security team wants to enforce that all IAM users and roles across all accounts can only perform actions on Amazon S3 buckets if the request is made through a specific VPC endpoint. They have already created an interface VPC endpoint for S3 in a central shared services VPC and shared it with all accounts using AWS PrivateLink. Which configuration should a solutions architect implement to meet this requirement?

Accepted Answer

Attach a service control policy (SCP) to the root that denies all s3:* actions unless the aws:sourceVpce condition matches the VPC endpoint ID.. To enforce that all S3 actions across all accounts must use a specific VPC endpoint, an SCP attached to the organization root is the most effective. It applies to all member accounts and can deny actions unless the aws:sourceVpce condition matches the endpoint ID. This provides centralized, preventive control without per-bucket policies.

Answer

Enable AWS CloudTrail data events for S3 in all accounts and use Amazon EventBridge to trigger a remediation Lambda function when a non-compliant request is detected.

Answer

Create an S3 bucket policy in each account that denies all s3:* actions unless the aws:sourceVpce condition matches the VPC endpoint ID.

Answer

Use AWS Network Firewall in the shared services VPC to inspect all traffic to S3 and block requests that do not originate from the VPC endpoint.

Question 4

A company operates a multi-account AWS environment managed with AWS Organizations. A central security account must collect AWS CloudTrail management events from every account and store them in a single Amazon S3 bucket owned by the security account. The company wants the least operational overhead and a solution that scales as new accounts are added. Which two actions should a solutions architect take? (Choose two.)

Accepted Answer

Configure the S3 bucket policy to allow the CloudTrail service principal to put objects, and ensure the bucket is in the same Region as the trail.. An organization trail created in the management account automatically logs management events for all accounts and delivers them to the central S3 bucket, which scales as accounts are added. The bucket policy must allow the CloudTrail service principal to write objects. Together these actions provide centralized, low-overhead collection of CloudTrail events across the organization.

Answer

Create an individual trail in each member account and configure each trail to deliver to the central S3 bucket using a cross-account bucket policy.

Answer

Enable AWS CloudTrail Insights in every member account and forward the insights events to the central S3 bucket.

Answer

Use AWS Config aggregators in the security account to collect CloudTrail event history from all accounts into the central S3 bucket.

Question 5

A company has a multi-account AWS environment managed by AWS Organizations. The compliance team requires that all Amazon S3 buckets in all accounts have server access logging enabled and that the logs are delivered to a central logging bucket in the audit account. The company wants to enforce this automatically for existing and future buckets. What should a solutions architect recommend?

Accepted Answer

Deploy an AWS Config rule in all accounts using AWS Organizations that checks for server access logging and use AWS CloudFormation StackSets to deploy a custom remediation that enables logging on non-compliant buckets.. Using AWS Config rules deployed through AWS Organizations provides continuous compliance monitoring for all S3 buckets across accounts. Combined with automated remediation, it ensures that any bucket lacking server access logging is corrected, regardless of how it was created. This meets the enforcement requirement for both existing and future buckets.

Answer

Create an SCP that denies s3:CreateBucket unless the request includes the s3:x-amz-server-access-logging header, and use a Lambda function to enable logging on existing buckets.

Answer

Use AWS Config conformance packs deployed via AWS Organizations to detect buckets without logging and automatically remediate using AWS Systems Manager Automation.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates an S3 bucket with logging enabled and a bucket policy to deliver logs to the central bucket. Configure automatic deployments for new accounts.

Question 6

A large enterprise has an AWS Organizations structure with a dedicated shared services account that hosts a self-managed Active Directory on EC2 instances. The company has 25 VPCs across multiple accounts and Regions, all connected via a transit gateway. The identity team wants to allow users in all accounts to authenticate against the shared Active Directory without deploying domain controllers in each VPC, and wants to minimize cross-Region authentication latency. Which solution should a solutions architect recommend?

Accepted Answer

Keep the self-managed Active Directory in the shared services account, ensure the transit gateway routes DNS and Kerberos traffic from all VPCs to the shared services VPC, and configure each VPC's DHCP options set to point to the domain controllers for DNS.. Because the company already operates a self-managed Active Directory, the simplest and most cost-effective approach is to make that directory reachable from every VPC through the existing transit gateway and to direct DNS and Kerberos traffic to the domain controllers using DHCP options sets. This avoids deploying redundant directory infrastructure while meeting the authentication and latency goals.

Answer

Create a one-way outgoing trust from the existing self-managed Active Directory to AWS Managed Microsoft AD in the shared services account, and use the transit gateway to route authentication traffic from all VPCs.

Answer

Deploy a read-only domain controller (RODC) in each workload VPC and configure a two-way trust between each RODC and the self-managed Active Directory.

Answer

Deploy AWS Managed Microsoft AD in the shared services account in each Region where workloads exist, and use VPC peering from each workload VPC to the shared services VPC.

Question 7

A startup has a single AWS account and wants to give a third-party auditing firm read-only access to its AWS billing and usage data without creating IAM users for the firm. The firm uses its own AWS account. Which solution is the MOST secure and operationally efficient?

Accepted Answer

Create an IAM role with a trust policy allowing the auditing firm's AWS account to assume it, and attach the AWSBillingReadOnlyAccess managed policy.. Cross-account IAM role assumption is the recommended way to grant an external AWS account access to your resources. The auditing firm assumes the role using its own identity, so no IAM users or long-term credentials are created in the startup account. Attaching the AWSBillingReadOnlyAccess managed policy provides exactly the read-only billing and usage permissions needed.

Answer

Enable AWS Organizations and invite the auditing firm's account, then create an SCP granting billing read access.

Answer

Generate a presigned URL for the AWS Billing console and share it with the auditing firm.

Answer

Create an IAM user for each auditor with the AWSBillingReadOnlyAccess managed policy and share the credentials securely.

Question 8

A company has an AWS Organizations environment with a central shared services account that hosts an AWS Managed Microsoft AD directory. Workload accounts in different OUs need to join Amazon EC2 instances to this directory, and the security team wants to control which accounts can perform directory joins without duplicating the directory. The company also wants to avoid sharing directory credentials. Which approach should a solutions architect use?

Accepted Answer

Share the AWS Managed Microsoft AD directory with workload accounts using AWS Resource Access Manager, and grant the AWS Managed Microsoft AD service-linked role permissions in each account.. AWS Managed Microsoft AD supports sharing a directory with other accounts through AWS Resource Access Manager. Workload accounts can then join EC2 instances to the shared directory without duplicating it or exchanging credentials. The service-linked role must exist in each account for the directory to operate, making this the correct centralized, secure approach.

Answer

Export the directory's service account credentials to AWS Secrets Manager and have workload accounts retrieve them to join instances.

Answer

Create a new AWS Managed Microsoft AD directory in each workload account and establish a forest trust with the central directory.

Answer

Deploy an AD connector in each workload account and point it to the central directory using LDAP over the public internet.

Question 9

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions and wants to ensure that users can authenticate to AWS Managed Microsoft AD from all VPCs. The company also wants to minimize latency for authentication requests. Which solution should a solutions architect recommend?

Accepted Answer

Deploy AWS Managed Microsoft AD in each Region and set up a trust relationship between the directories. Configure each VPC to use the local AD domain controllers for DNS.. Deploying AWS Managed Microsoft AD in each Region ensures that authentication requests are handled by local domain controllers, minimizing latency. A trust relationship between the directories enables users to authenticate across Regions, providing a seamless experience. Configuring each VPC to use the local AD for DNS ensures that domain resolution stays within the Region, further reducing latency.

Answer

Deploy AWS Managed Microsoft AD in one Region and use VPC peering to connect all VPCs to the AD VPC. Configure DNS forwarding from each VPC to the AD VPC.

Answer

Deploy AWS Managed Microsoft AD in one Region and use AWS Transit Gateway to connect all VPCs. Configure each VPC to use the AD domain controllers in the central Region for DNS.

Answer

Deploy AWS Managed Microsoft AD in each Region and use AWS Resource Access Manager to share the directories with all accounts. Configure each VPC to use the shared directory for DNS.

Question 10

A company has a multi-account AWS environment with a central network account that hosts a transit gateway (TGW). Workload accounts are attached to the TGW. The security team requires that all inter-VPC traffic between workload accounts be inspected by a centralized firewall appliance in the network account. The firewall appliance is deployed in a separate VPC and uses a Gateway Load Balancer (GWLB) endpoint. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Configure the firewall VPC with a route to the TGW for all workload VPC CIDR blocks, and ensure the TGW route table for the firewall attachment sends traffic back to the appropriate workload VPC.. To inspect inter-VPC traffic via a centralized firewall, workload VPCs must route traffic to the TGW, and the TGW must direct it to the firewall VPC. The firewall VPC must then route inspected traffic back to the TGW for delivery to the destination. This requires proper routing in both workload VPCs and the firewall VPC, along with TGW route table configurations that force traffic through the firewall attachment.

Answer

Attach the firewall VPC to the TGW and create a static route in the TGW route table for the firewall VPC CIDR pointing to the workload attachments.

Answer

Create a TGW route table in the network account that associates the workload VPC attachments and propagates routes to the firewall VPC attachment.

Answer

Enable appliance mode on the TGW attachment for the firewall VPC to ensure flow symmetry for traffic that traverses the firewall.

Question 11

A financial services company has an AWS Organizations structure with 40 member accounts under a management account. The security team needs to prevent any principal in member accounts from disabling AWS CloudTrail or modifying its configuration, even if a user has AdministratorAccess in that account. They also want to allow a designated security role in the management account to make changes. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an SCP that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail, with a condition that the principal ARN is not the designated security role, and attach it to all member accounts.. Service control policies are the only AWS Organizations mechanism that can restrict what principals in member accounts can do, regardless of their IAM permissions. By denying the CloudTrail stop, delete, and update actions and exempting a trusted security role, the company prevents tampering while allowing authorized changes. This is centralized, low-overhead, and directly addresses the preventive requirement.

Answer

Use AWS Config rules in each member account to detect when CloudTrail is stopped or modified, and trigger an AWS Lambda function to re-enable it.

Answer

Enable AWS CloudTrail organization trail and configure S3 bucket policies to deny non-security principals from reading the logs.

Answer

Attach an IAM policy to every IAM role in each member account that denies CloudTrail configuration changes, and use AWS Organizations tag policies to enforce it.

Question 12

A company is using AWS Organizations with multiple accounts. They want to implement a centralized backup solution for Amazon RDS databases across all accounts. The solution must automatically back up RDS instances to a central backup vault in a dedicated backup account, and allow cross-account restore. Which two actions should they take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS Backup policies within AWS Organizations to define backup plans that automatically back up RDS instances in all accounts to a central vault in the backup account.. To centrally back up RDS instances across accounts, you should use AWS Backup policies within AWS Organizations to automatically apply backup plans to all accounts. Additionally, the central backup vault must have a resource-based policy that grants permission to other accounts to copy backups and restore from it. These two actions together enable centralized backup and cross-account restore.

Answer

Use AWS CloudFormation StackSets to deploy a backup plan in each account that targets the central vault.

Answer

Create an AWS Backup vault in the backup account and configure a backup plan that includes all RDS instances across accounts using AWS Resource Access Manager (RAM) to share the vault.

Answer

Enable AWS Organizations trusted access for AWS Backup and create a backup plan in each account that points to the central vault.

Question 13

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that IAM users in all member accounts are required to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company wants a centralized solution that applies to all accounts and cannot be overridden by account administrators. What should the solutions architect recommend?

Accepted Answer

Create an SCP that denies all actions unless the principal has authenticated with MFA, and attach it to the root of the organization.. A service control policy attached to the organization root can enforce MFA for all IAM principals across all accounts. By denying actions unless the aws:MultiFactorAuthPresent condition is true, it ensures that users must authenticate with MFA. This is centralized, preventive, and cannot be overridden by account administrators.

Answer

Deploy a Lambda function in each account that periodically checks IAM users for MFA devices and disables users without MFA.

Answer

Enable MFA requirement in the management account's IAM settings, which propagates to all member accounts.

Answer

Use AWS IAM Identity Center to enforce MFA for all users and disable IAM users in all accounts.

Question 14

A company has a multi-account AWS environment with AWS Organizations. The security team wants to enforce that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. The company also wants to ensure that any new accounts automatically inherit this policy. What is the MOST efficient way to achieve this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) that denies all actions unless the principal has authenticated with MFA.. An AWS Organizations service control policy (SCP) can enforce MFA requirements across all accounts in the organization. By denying actions when MFA is not present, the SCP ensures that all IAM users must use MFA. Because SCPs are applied at the organization or OU level, new accounts automatically inherit the policy, providing centralized and efficient enforcement.

Answer

Create an IAM policy in each account that denies console access unless MFA is present, and attach it to all IAM users.

Answer

Enable AWS CloudTrail to monitor MFA usage and use AWS Config rules to remediate non-compliant users.

Answer

Configure AWS IAM Identity Center (successor to AWS Single Sign-On) and require MFA for all users.

Question 15

A company has an AWS Organizations setup with a central security account and 200 member accounts. The security team wants to grant a third-party auditing firm read-only access to specific AWS Config and CloudTrail data across all accounts. The auditing firm uses its own AWS account and must not be able to access any other resources. The security team wants to manage this access centrally and revoke it easily when the engagement ends. Which solution should a solutions architect recommend?

Accepted Answer

In the management account, create an IAM role that trusts the auditing firm's account, and use the role to assume a read-only role in each member account via a central trust chain, with permissions scoped to Config and CloudTrail.. A central role in the management account that the auditing firm can assume, combined with the ability to chain into scoped read-only roles in member accounts, provides centralized management and easy revocation. The auditing firm uses a single entry point, and the member account roles limit access strictly to Config and CloudTrail data, satisfying the least-privilege requirement.

Answer

Create a single IAM role in the security account with a trust policy allowing the auditing firm's account, and grant the role cross-account read access to Config and CloudTrail data by using AWS Resource Access Manager to share the data sources.

Answer

Create an IAM role in each member account with a trust policy allowing the auditing firm's account, and attach a read-only policy scoped to Config and CloudTrail. Use AWS CloudFormation StackSets to deploy the role to all accounts.

Answer

Use AWS IAM Identity Center to create a permission set with read-only access to Config and CloudTrail, assign it to the auditing firm's users, and provision the permission set to all accounts.