SAP-C02 Design Solutions for Organizational Complexity Practice Test 23 — 15 Questions

Question 1

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.. AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule. Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

Question 2

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

Accepted Answer

Use attribute-based access control (ABAC) with IAM Identity Center and session tags from Active Directory.. It uses attribute-based access control (ABAC) with IAM Identity Center, which allows permissions to be dynamically granted based on user attributes (e.g., job function) passed as session tags from Active Directory. This approach scales seamlessly as users and accounts grow, since policies reference tags rather than individual users or groups, and it centralizes identity management without requiring per-account role updates.

Answer

Create a permission set in IAM Identity Center for each job function and assign to appropriate groups.

Answer

Use AWS Organizations to attach SCPs that grant permissions based on user tags.

Answer

Use IAM roles directly in each account and manage trust policies centrally.

Question 3

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

Accepted Answer

Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.. Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.

Answer

Use an SCP to require that CloudTrail is enabled.

Answer

Use IAM policies in each account to deny the same actions.

Answer

Use AWS Config rules to detect and remediate changes.

Question 4

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 5

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

Accepted Answer

Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.. AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Answer

Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.

Answer

Use AWS Cost Explorer to filter by resource tags after they are manually applied.

Question 6

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

Accepted Answer

Deny effect with ec2:* and rds:* as the actions.. AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Answer

Deny effect with "*" as the action.

Answer

Deny effect with NotAction set to ec2:* and rds:*.

Answer

Allow effect with ec2:* and rds:* as the actions.

Question 7

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Accepted Answer

Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.. CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Answer

Use a VPC endpoint and route logs through a central VPC.

Answer

Attach an SCP to allow CloudTrail to write to the central bucket.

Answer

Create an IAM role in each member account and allow the central account to assume it.

Question 8

A company has a multi-account AWS environment. They want to ensure that any new account created in the organization automatically gets a specific set of IAM roles and AWS Config rules deployed. Which solution requires the least manual effort?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to the organization.. AWS CloudFormation StackSets with automatic deployment to the organization is the correct solution because it allows you to define a set of AWS resources (IAM roles, Config rules) as a CloudFormation template and automatically deploy it to every account in the organization, including newly created accounts, without any manual intervention. StackSets can be configured to deploy to all accounts in the organization or specific OUs, and they automatically handle the deployment to new accounts as they join the organization.

Answer

Use AWS Organizations and attach a tag policy that requires the roles and rules.

Answer

Attach an SCP to the root OU that creates the roles and rules.

Answer

Use AWS Lambda to periodically scan for new accounts and deploy resources.

Question 9

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.. AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Answer

Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

Answer

Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

Answer

Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

Question 10

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

Accepted Answer

Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.. AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to centrally enforce that any API action is denied unless the request includes MFA. By using the `aws:MultiFactorAuthPresent` condition key set to `false`, the SCP effectively blocks all AWS actions (including console login) for any principal that has not authenticated with MFA. This ensures a blanket, unmodifiable guard across all member accounts, even preventing account administrators from bypassing the requirement.

Answer

Use AWS CloudTrail to detect console logins without MFA and send alerts.

Answer

Require each IAM user to have a virtual MFA device assigned.

Answer

Create an IAM group for users without MFA and deny them console access.

Question 11

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Accepted Answer

Create a private hosted zone in the central networking account.. A private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Answer

Create a public hosted zone with the same name and configure DNSSEC.

Answer

Create a Route 53 Resolver outbound endpoint in each account.

Question 12

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Accepted Answer

Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.. AWS IAM Identity Center can use AWS Managed Microsoft AD as its identity source, enabling seamless synchronization of users and groups from an existing on-premises Active Directory via a two-way forest trust. This eliminates the need for manual import and provides a managed, highly available directory service that integrates directly with IAM Identity Center for single sign-on across multiple AWS accounts.

Answer

Create an IAM Identity Center identity store and manually import users from Active Directory.

Answer

Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.

Answer

Configure AWS CloudTrail to log all sign-in events.

Question 13

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Accepted Answer

To ensure that only requests originating from accounts within the specified organization are allowed.. The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Answer

To restrict access to only the root user of the management account.

Answer

To enforce that all requests are made using HTTPS.

Answer

To allow access only from specific IP addresses within the organization.

Question 14

Refer to the exhibit. A security engineer ran this AWS CLI command to investigate who created a CloudTrail trail in January 2024. The command returned no results. However, the security team knows that a trail was created during that period. What is the most likely reason for the empty result?

Accepted Answer

The trail was created in a different region and the command did not specify a region.. The AWS CLI command `aws cloudtrail lookup-events` defaults to the region configured in the AWS CLI profile (e.g., `us-east-1`). If the CloudTrail trail was created in a different region, the command will return no results unless the `--region` parameter is explicitly specified. Since the security team knows the trail was created in January 2024, the most likely reason for the empty result is that the command did not target the correct region.

Answer

The start time is too far in the past and CloudTrail only retains events for 90 days.

Answer

The trail was created using the AWS Management Console, not the CLI.

Answer

The command syntax is incorrect; the --lookup-attributes parameter should be --attribute.

Question 15

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Accepted Answer

It denies all actions if the request is not made over HTTPS.. This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS. Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Answer

It denies all actions if the request does not include multi-factor authentication.

Answer

It denies all actions from IP addresses outside the corporate network.

Answer

It allows all actions as long as the request is made over HTTPS.