SAP-C02 Design Solutions for Organizational Complexity Practice Test 24 — 15 Questions

Question 1

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Accepted Answer

License configurations. Option A is correct because AWS License Manager configurations can be shared across accounts using AWS Resource Access Manager (RAM), enabling centralized management of software licenses. This allows organizations to enforce license usage limits and rules consistently across multiple accounts in an AWS Organization.

Answer

VPC peering connections

Answer

Security groups

Question 2

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

Accepted Answer

Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.. Option A is correct because it uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Answer

Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

Answer

Use the root user of each account to access the buckets.

Answer

Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

Question 3

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

Accepted Answer

Attach an SCP that denies the restricted instance types to the OU.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Answer

Use AWS CloudTrail to monitor and alert when restricted instance types are launched.

Answer

Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.

Answer

Attach an SCP to the root of the organization and exclude the management account.

Question 4

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a transit gateway owned by a central network account with other AWS accounts in your organization. This eliminates the need to create separate transit gateway attachments or VPC peering connections, simplifying network architecture and reducing operational overhead.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Direct Connect

Question 5

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

Accepted Answer

Apply an SCP to the development account that denies iam:CreateUser.. Option C is correct because an SCP can deny the iam:CreateUser action in the development account. Option A is wrong because IAM policies attached to developers affect their user permissions, but if they have admin privileges, they can bypass. Option B is wrong because IAM groups can be bypassed if users have other permissions. Option D is wrong because CloudTrail only logs, does not prevent.

Answer

Create an IAM group for developers with a policy that denies iam:CreateUser.

Answer

Enable AWS CloudTrail to monitor iam:CreateUser calls.

Answer

Attach an IAM policy to each developer user that denies iam:CreateUser.

Question 6

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Accepted Answer

Designate a delegated administrator account for GuardDuty in AWS Organizations.. Option C is correct because designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Answer

Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.

Answer

Create a new S3 bucket in each account to store GuardDuty findings.

Question 7

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.. AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Answer

Use AWS Config rules to enforce the IAM role creation in each account.

Answer

Manually create the IAM role in each account using the AWS Management Console.

Answer

Use AWS Organizations to create the IAM role via a service control policy (SCP).

Question 8

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.. Option C is correct because AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Answer

AWS PrivateLink to route traffic through a centralized security appliance in a single account.

Answer

VPC Peering connections between all VPCs and use security groups to control traffic.

Answer

AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.

Question 9

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

Accepted Answer

Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.. Option D is correct because S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Answer

Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

Answer

Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

Question 10

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

Accepted Answer

Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.. Option B is correct because cost allocation tags are designed for this purpose and can be activated in AWS Organizations centrally. Option A is wrong because individual tags in each account are not automatically propagated. Option C is wrong because linked accounts do not track tags across accounts. Option D is wrong because it forces account-per-project which is not flexible.

Answer

Create separate AWS accounts for each project and use consolidated billing to view costs.

Answer

Use AWS Budgets with cost allocation tags to track project costs.

Answer

Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.

Question 11

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

Accepted Answer

Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.. AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Answer

Use AWS Organizations service control policies to deny cross-account access.

Answer

Use AWS Trusted Advisor to check for unused cross-account roles.

Answer

Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

Question 12

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon S3 Select to retrieve only the relevant log entries based on the IP address and time range.. Amazon S3 Select allows you to retrieve only a subset of data from an object using SQL expressions, making it highly cost-effective for scanning large log files for specific IP addresses and time ranges. It reduces the amount of data transferred and processed compared to reading the entire object, and it scales automatically without provisioning any infrastructure. This approach is ideal for ad-hoc queries on structured or semi-structured log data stored in S3.

Answer

Use Amazon Athena to query the logs directly in S3.

Answer

Stream the logs to Amazon OpenSearch Service for real-time querying.

Answer

Use AWS Glue to catalog the logs and query with Amazon Redshift Spectrum.

Question 13

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 14

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. Option B is correct because AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 15

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

Accepted Answer

Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.. AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Answer

Use an SCP that denies all IAM actions except those from a specific admin account.

Answer

Use an IAM password policy that requires multi-factor authentication for all users.

Answer

Create an IAM role in each account with full administrator access and use a break-glass process to assume it.