SAP-C02 Design Solutions for Organizational Complexity Practice Test 24 — 15 Questions

Question 1

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.. A service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Answer

Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

Answer

Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

Question 2

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

Accepted Answer

Use AWS Control Tower account factory and AWS CloudFormation StackSets to deploy the VPC across all accounts.. AWS Control Tower's Account Factory combined with AWS CloudFormation StackSets enables automated, centralized deployment of identical VPC configurations across all 50 accounts in the same Region. StackSets allow you to deploy a CloudFormation template to multiple accounts and Regions from a single administrator account, ensuring consistency without manual intervention.

Answer

Use AWS CloudFormation templates manually triggered in each account.

Answer

Create a VPC in one account and share it with other accounts using AWS Resource Access Manager (RAM).

Answer

Use AWS Organizations to create the VPC in each account via an SCP.

Question 3

A company uses a single AWS account for development and production workloads. To improve security and cost allocation, the company decides to separate environments into multiple accounts. What is the PRIMARY benefit of using multiple accounts?

Accepted Answer

Enabling centralized security controls and consolidated billing.. Separating environments into multiple AWS accounts provides a strong security boundary (via AWS Organizations SCPs) and enables consolidated billing with cost allocation tags. This allows centralized security controls (e.g., guardrails, IAM policies) across accounts while aggregating usage for volume discounts, which is the primary benefit for improving security and cost allocation.

Answer

Reducing overall compute costs by sharing reserved instances across environments.

Answer

Simplifying backup and disaster recovery procedures.

Answer

Decreasing network latency between development and production environments.

Question 4

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Accepted Answer

Centrally enforce policies using service control policies (SCPs).. Service control policies (SCPs) allow you to centrally manage permissions for all accounts in your AWS Organizations hierarchy. SCPs act as a guardrail, enabling you to define the maximum available permissions for IAM roles and users across member accounts without granting any permissions themselves. This ensures consistent enforcement of security and compliance policies across the entire organization.

Answer

Automatically create VPC peering connections between accounts.

Answer

Simplify cross-region replication for Amazon RDS databases.

Answer

Reduce the total cost of EC2 instances by aggregating usage across accounts.

Question 5

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.

Question 6

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Accepted Answer

License configurations. AWS License Manager configurations can be shared across accounts using AWS Resource Access Manager (RAM), enabling centralized management of software licenses. This allows organizations to enforce license usage limits and rules consistently across multiple accounts in an AWS Organization.

Answer

VPC peering connections

Answer

Security groups

Question 7

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

Accepted Answer

Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.. It uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Answer

Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

Answer

Use the root user of each account to access the buckets.

Answer

Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

Question 8

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

Accepted Answer

Attach an SCP that denies the restricted instance types to the OU.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Answer

Use AWS CloudTrail to monitor and alert when restricted instance types are launched.

Answer

Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.

Answer

Attach an SCP to the root of the organization and exclude the management account.

Question 9

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a transit gateway owned by a central network account with other AWS accounts in your organization. This eliminates the need to create separate transit gateway attachments or VPC peering connections, simplifying network architecture and reducing operational overhead.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Direct Connect

Question 10

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

Accepted Answer

Apply an SCP to the development account that denies iam:CreateUser.. Service Control Policies (SCPs) are the most effective way to enforce permissions boundaries across entire accounts in AWS Organizations. An SCP applied to the development account will deny the `iam:CreateUser` action for all principals (including the root user) in that account, regardless of any IAM policies attached to users or roles. This ensures developers cannot create IAM users, even if they have full administrative access within the account.

Answer

Create an IAM group for developers with a policy that denies iam:CreateUser.

Answer

Enable AWS CloudTrail to monitor iam:CreateUser calls.

Answer

Attach an IAM policy to each developer user that denies iam:CreateUser.

Question 11

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Accepted Answer

Designate a delegated administrator account for GuardDuty in AWS Organizations.. Designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Answer

Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.

Answer

Create a new S3 bucket in each account to store GuardDuty findings.

Question 12

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.. AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Answer

Use AWS Config rules to enforce the IAM role creation in each account.

Answer

Manually create the IAM role in each account using the AWS Management Console.

Answer

Use AWS Organizations to create the IAM role via a service control policy (SCP).

Question 13

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.. AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Answer

AWS PrivateLink to route traffic through a centralized security appliance in a single account.

Answer

VPC Peering connections between all VPCs and use security groups to control traffic.

Answer

AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.

Question 14

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

Accepted Answer

Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.. S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Answer

Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

Answer

Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

Question 15

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

Accepted Answer

Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.. AWS Cost Categories allow you to group costs based on shared tags, accounts, or other dimensions across multiple accounts in an AWS Organization. This is the most scalable approach for tracking costs by project when resources span multiple accounts, as it centralizes cost allocation without requiring manual tag activation per account.

Answer

Create separate AWS accounts for each project and use consolidated billing to view costs.

Answer

Use AWS Budgets with cost allocation tags to track project costs.

Answer

Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.