SAP-C02 Design Solutions for Organizational Complexity Practice Test 24 — 15 Questions

Question 1

A company has an AWS Organizations setup with a management account and multiple member accounts. The company wants to centrally manage AWS Config rules across all accounts to ensure compliance with internal policies. They need to deploy the same set of AWS Config rules to all existing and future accounts, and they want to aggregate compliance data in a central account. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config conformance packs deployed via AWS Organizations. Create a conformance pack in the management account and deploy it to all accounts in the organization. Use an aggregator in the central account to collect compliance data.. AWS Config conformance packs can be deployed organization-wide using AWS Organizations integration, automatically applying to new accounts. An aggregator in a central account collects compliance data from all accounts. This provides centralized management and aggregation with minimal operational effort, meeting the requirements.

Answer

Use AWS Security Hub in the management account to deploy AWS Config rules to all accounts. Security Hub automatically enables Config in all accounts and aggregates findings.

Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules to all accounts, and use AWS Config aggregator in the central account to collect compliance data.

Answer

Create an AWS Config rule in each account manually. Use AWS Lambda to periodically copy compliance data to a central Amazon S3 bucket and analyze it with Amazon Athena.

Question 2

A company is building a landing zone with AWS Control Tower. The security team wants to ensure that all accounts created through Account Factory are governed consistently and that a baseline of detective controls is applied automatically. (Choose two.)

Accepted Answer

Use AWS Control Tower Account Factory to provision new accounts and rely on the default landing zone guardrails.. AWS Control Tower applies mandatory and strongly recommended controls to every enrolled account, and Account Factory provisions new accounts with the landing zone guardrails already in place. Together, these ensure that all accounts created through Account Factory inherit a consistent detective and preventive control baseline without manual intervention.

Answer

Enable AWS CloudTrail organization trails and require each account to create its own trail in the management account.

Answer

Create an AWS CloudFormation StackSet in each account that deploys AWS Config rules manually after account creation.

Answer

Configure AWS Organizations service control policies to deny all AWS Config actions in member accounts.

Question 3

A financial services company uses AWS Organizations with 40 accounts. The security team must ensure that no S3 bucket in any member account can be made public, and they want a single, centrally managed guardrail that cannot be overridden by account administrators. Which solution should a solutions architect recommend?

Accepted Answer

Enable S3 Block Public Access at the organization level using the AWS Organizations console.. S3 Block Public Access applied at the organization level is the only option that provides a preventive, centralized, non-overridable control across all current and future accounts. It directly prevents any bucket from becoming public, regardless of account-level administrator actions, satisfying the requirement for a single centrally managed guardrail.

Answer

Attach an SCP to the root that denies s3:PutBucketPolicy and s3:PutBucketAcl actions.

Answer

Use AWS Config conformance packs to detect public buckets and auto-remediate with a Lambda function.

Answer

Enable default encryption and require SSE-KMS on all buckets via a bucket policy deployed by StackSets.

Question 4

A company has a multi-account AWS environment with AWS Organizations. The compliance team requires that all Amazon S3 buckets in member accounts are encrypted with AWS KMS customer managed keys (CMKs) and that the keys are rotated annually. They also need to prove compliance to auditors. Which solution meets these requirements with the LEAST effort?

Accepted Answer

Deploy an AWS Config conformance pack in each member account that checks for S3 bucket encryption with KMS CMKs and annual key rotation, and use AWS Config aggregator for centralized compliance reporting.. AWS Config conformance packs provide a pre-built set of rules that can evaluate S3 bucket encryption and KMS key rotation across accounts. An aggregator centralizes compliance data, making it easy to demonstrate compliance to auditors. This solution is scalable, requires minimal custom development, and leverages native AWS services for continuous monitoring.

Answer

Create an AWS Lambda function in each account that runs on a schedule to check S3 bucket encryption and KMS key rotation, and write results to a central S3 bucket.

Answer

Use an SCP to deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header with a valid CMK ARN, and enable automatic key rotation on all CMKs.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates S3 buckets with encryption and a KMS key with rotation enabled, and enforce that all buckets are created via this template.

Question 5

A financial services company has an AWS Organizations structure with 200 member accounts. The security team wants to centrally manage a set of approved IAM roles that can be assumed by auditors across all accounts. They need to ensure that the roles are consistent and that any changes are automatically applied to all accounts. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS IAM Identity Center (successor to AWS Single Sign-On) to define permission sets that provision IAM roles in all accounts automatically.. IAM Identity Center (formerly AWS SSO) is designed for centralized management of access across multiple accounts in AWS Organizations. Permission sets are templates that automatically create and update IAM roles in each account, ensuring consistency and reducing operational overhead. This solution aligns with the requirement to centrally manage approved roles for auditors and apply changes automatically.

Answer

Create an IAM role in each account manually and use AWS Organizations service control policies to enforce the role's permissions.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles to all accounts, with the stack set managed from the management account.

Answer

Use AWS Organizations to create a centralized IAM role in the management account and grant cross-account access to all member accounts.

Question 6

A company uses AWS Organizations with service control policies (SCPs) to manage permissions. The security team wants to ensure that IAM principals in member accounts cannot delete AWS CloudTrail trails or stop logging, even if they have administrative permissions in their account. The SCP must apply to all member accounts but not affect the management account. Which SCP strategy meets these requirements?

Accepted Answer

Create an SCP that denies the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, and attach it to all organizational units (OUs) that contain member accounts.. SCPs attached to organizational units (OUs) apply to all accounts within those OUs, providing centralized enforcement without affecting the management account. By attaching the deny SCP to all OUs containing member accounts, the policy automatically applies to current and future accounts in those OUs. This is the recommended approach for protecting CloudTrail configurations across an organization.

Answer

Create an SCP that denies the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, and attach it to each member account individually.

Answer

Create an SCP that denies the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, and attach it to the management account only.

Answer

Create an SCP that denies the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions, and attach it to the root of the organization.

Question 7

A healthcare company runs a multi-account AWS environment with AWS Organizations. It needs to provide its data science team with read-only access to a centralized Amazon S3 data lake in the data account, while ensuring that access is auditable and that the team cannot access data from other business units. The company wants to minimize operational overhead and avoid creating individual IAM users. Which two steps should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Create an IAM role in the data account with a trust policy that allows federation from the identity provider and a permissions policy granting s3:GetObject and s3:ListBucket on the specific data lake bucket prefixes.. The combination of an IAM role in the data account with a trust policy for federation and a scoped permissions policy, plus IAM Identity Center permission sets assigned to the data science group, provides secure, auditable, and scalable access. This avoids IAM users, enforces least privilege, and leverages centralized identity management, meeting all requirements with minimal operational overhead.

Answer

Deploy an Amazon Cognito user pool and identity pool to authenticate data scientists and grant them direct access to the S3 bucket using temporary AWS credentials.

Answer

Create an IAM user for each data scientist in the data account and attach a managed policy that allows s3:GetObject on the data lake bucket.

Answer

Use an S3 bucket policy that grants access to the entire organization's account principals, and rely on SCPs to restrict access to the data lake for other business units.

Question 8

A company has a multi-account AWS environment with a central IT account and 100 application accounts. The IT team wants to centrally manage the creation of IAM roles that grant cross-account access to a central S3 bucket for data processing. The solution must allow the IT team to define the roles and their permissions, and automatically deploy them to all application accounts. The application accounts should not be able to modify these roles. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy IAM roles to all accounts in the organization.. Using CloudFormation StackSets with service-managed permissions allows the IT team to centrally define and deploy IAM roles to all application accounts. An SCP that restricts IAM role creation and policy attachment to only the StackSets execution role prevents application accounts from altering the roles. Together, these actions provide centralized management and enforcement.

Answer

Use AWS Organizations to create a service-linked role in each account that grants cross-account access to the central S3 bucket.

Answer

Deploy a Lambda function in each application account that creates the IAM roles based on a central configuration stored in Amazon S3.

Answer

Create the IAM roles in the central IT account and use AWS Resource Access Manager to share them with the application accounts.

Question 9

A company runs a shared services VPC in its central AWS account. Several workload accounts in the same AWS Organization need to reach an on-premises DNS zone named corp.internal that is hosted on self-managed BIND servers connected through AWS Site-to-Site VPN. Each workload VPC already has a DHCP option set pointing to the shared services VPC resolver. The network team wants to avoid managing per-account resolver endpoints. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

In the shared services account, create an Amazon Route 53 Resolver outbound endpoint and a forwarding rule for corp.internal. Share the rule with the organization using AWS Resource Access Manager, and associate it with each workload VPC.. Centralizing the conditional forwarder in the shared services account with a Resolver outbound endpoint, then sharing that rule through AWS Resource Access Manager, lets every workload VPC resolve corp.internal without deploying endpoints per account. Workload instances already use the shared resolver through their DHCP option set, so queries traverse the VPN to the BIND servers. This design minimizes duplicate infrastructure while preserving a single source of DNS truth.

Answer

In every workload account, deploy a Route 53 Resolver inbound endpoint and a forwarding rule for corp.internal, then point each VPC's DHCP option set at its local inbound endpoint.

Answer

Create a Route 53 private hosted zone named corp.internal in the shared services account, share it with the organization, and create A records for each on-premises BIND server.

Answer

Enable DNS hostnames and DNS resolution on each workload VPC and create a VPC peering connection to the shared services VPC so the default resolver can forward corp.internal queries.

Question 10

A financial services company has an AWS Organizations setup with 40 accounts. They use AWS Resource Access Manager (RAM) to share a central VPC subnet with several workload accounts. The security team now wants to prevent any workload account from modifying the shared subnet's route tables, while still allowing them to launch resources into the subnet. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Create a service control policy (SCP) in AWS Organizations that denies the ec2:CreateRoute and ec2:ReplaceRoute actions on the shared subnet's route tables, and attach it to the workload accounts.. A service control policy attached at the organizational unit or account level is the only mechanism that centrally restricts actions across multiple accounts without per-account IAM changes. Denying route table modification actions on the shared subnet preserves the ability to launch resources while blocking the unwanted changes.

Answer

Use AWS Resource Access Manager to share the route tables with only the central networking account, and remove the share from workload accounts.

Answer

Attach an IAM permissions boundary to each workload account's administrator role that denies route table modifications, and update it whenever new accounts are added.

Answer

Enable AWS CloudTrail in the central networking account and configure Amazon EventBridge to revert unauthorized route table changes automatically.

Question 11

A company uses AWS Organizations with a management account and multiple member accounts. The company wants to centrally manage DNS records for all accounts using Amazon Route 53. Each member account has its own VPCs and needs to resolve internal DNS names for services in other member accounts. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Create a central private hosted zone in a shared services account, associate all member VPCs with it using AWS Resource Access Manager, and create records for all services in that zone.. Sharing a private hosted zone from a central account using AWS Resource Access Manager allows member accounts to associate their VPCs and resolve records. Managing all records in one zone reduces administrative effort and provides centralized control, meeting the cross-account DNS resolution requirement.

Answer

Create a private hosted zone in each member account and use VPC peering to allow cross-account DNS resolution.

Answer

Use AWS Direct Connect to connect all VPCs to a central DNS server running on Amazon EC2.

Answer

Enable DNS resolution in each VPC and use Route 53 Resolver endpoints to forward queries to a central Resolver rule.

Question 12

A company has a multi-account AWS environment with a central network account that hosts a transit gateway. Workload accounts are attached to the transit gateway. The company wants to implement centralized inspection of all traffic between workload VPCs using a security VPC that contains AWS Network Firewall. They need to ensure that traffic between any two workload VPCs is inspected, and that the solution is scalable. Which configuration should they implement?

Accepted Answer

Enable appliance mode on the transit gateway attachment for the security VPC and configure route tables to direct traffic from workload VPCs to the security VPC for inspection.. Appliance mode on the transit gateway attachment for the security VPC ensures that traffic flows symmetrically through the security VPC, allowing stateful inspection by AWS Network Firewall. By configuring transit gateway route tables to direct inter-VPC traffic to the security VPC, all traffic between workload VPCs is inspected. This solution scales with the transit gateway and centralizes inspection.

Answer

Attach the security VPC to the transit gateway and create a transit gateway route table that sends all inter-VPC traffic to the security VPC attachment.

Answer

Create a peering connection between each workload VPC and the security VPC, and route all inter-VPC traffic through the security VPC.

Answer

Use AWS PrivateLink to create endpoint services in the security VPC for each workload VPC, and route traffic through those endpoints.

Question 13

A company has a multi-account AWS environment with AWS Organizations. The security team wants to enforce that all IAM roles created in any account must have a permissions boundary attached. They also want to ensure that the permissions boundary cannot be removed or changed by account administrators. Which solution should they implement?

Accepted Answer

Create a service control policy (SCP) that denies the iam:CreateRole action unless the request includes a permissions boundary, and deny iam:DeleteRolePermissionsBoundary and iam:PutRolePermissionsBoundary actions.. A service control policy (SCP) can enforce that IAM roles are created with a permissions boundary by denying iam:CreateRole unless the request includes a boundary. It can also deny actions that would remove or change the boundary, ensuring it cannot be altered by account administrators. This provides centralized, preventive enforcement across all accounts in the organization.

Answer

Create an IAM policy in each account that denies iam:CreateRole unless a permissions boundary is specified, and attach it to all users and roles.

Answer

Use AWS Config with a managed rule to detect IAM roles without permissions boundaries and automatically remediate by attaching a boundary using an AWS Lambda function.

Answer

Use AWS CloudFormation StackSets to deploy a Lambda function in each account that monitors IAM role creation and attaches a permissions boundary if missing.

Question 14

A company has a multi-account AWS environment with a central networking account and 20 workload accounts. All workload VPCs are attached to a central AWS Transit Gateway in the networking account. The company wants to share the Transit Gateway with all workload accounts and ensure that each workload account can only attach VPCs to the Transit Gateway, not create or modify Transit Gateway route tables. What should the solutions architect do?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the Transit Gateway with the organization, and create an SCP that denies tgw:CreateRouteTable and tgw:CreateTransitGateway actions in workload accounts.. Sharing the Transit Gateway through AWS RAM with the organization allows all workload accounts to attach VPCs. An SCP that denies Transit Gateway creation and route table creation actions ensures workload accounts cannot create or modify Transit Gateway route tables, fulfilling the centralized control and least privilege requirements.

Answer

Create a separate Transit Gateway in each workload account and peer them with the central Transit Gateway.

Answer

Use AWS CloudFormation StackSets to deploy a Transit Gateway in each workload account and configure attachments to the central Transit Gateway.

Answer

Share the Transit Gateway using AWS RAM with each workload account, and attach an IAM policy to each account's users that allows only ec2:CreateTransitGatewayVpcAttachment.

Question 15

A financial services company uses AWS Organizations with a central IT account and 200 workload accounts organized into 15 OUs. The security team must ensure that no new IAM user can be created in any workload account without an attached permissions boundary, and must prevent existing accounts from being moved out of the Organization. Which combination of controls should the solutions architect recommend?

Accepted Answer

Apply an SCP at the root that denies iam:CreateUser unless the request includes the permissions-boundary condition key, and deny organizations:LeaveOrganization in the same SCP.. A root-level service control policy applies to every account in the organization and cannot be overridden by account administrators, which is what makes it the correct preventive control for both the IAM user creation rule and the leave-organization restriction. The aws:PermissionsBoundary condition key lets the policy require a boundary on every CreateUser call.

Answer

Enable AWS Control Tower guardrails and rely on the mandatory preventive guardrail that blocks IAM user creation across all enrolled accounts.

Answer

Create an IAM permissions boundary in the management account and attach it to every role in the workload accounts using AWS CloudFormation StackSets.

Answer

Use AWS Config conformance packs in each workload account to detect IAM users created without a permissions boundary and auto-remediate with a custom Lambda function.