SAP-C02 Design Solutions for Organizational Complexity Practice Test 25 — 15 Questions

Question 1

A company is using AWS Organizations with consolidated billing. The finance team wants to allocate AWS costs to different departments and projects. They need to ensure that each department can only see and manage their own resources, and that costs are automatically tagged for chargeback. The company has multiple AWS accounts per department. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS Cost and Usage Reports (CUR) to deliver billing data to an S3 bucket, and use Amazon Athena to query the data for department-level cost allocation.. To allocate costs automatically, activate cost allocation tags and enforce them with tag policies. Then, use Cost and Usage Reports with Athena to query and generate detailed chargeback reports. This combination provides the necessary granularity and automation for departmental cost allocation. The other options either rely on manual processes or do not address cost allocation directly.

Answer

Create a separate AWS account for each department and use consolidated billing to combine all charges into a single bill, then manually split costs using spreadsheet analysis.

Answer

Use AWS Budgets to set spending limits for each department and receive alerts when thresholds are exceeded, then adjust budgets manually.

Answer

Implement IAM policies that restrict each department's users to only access resources tagged with their department, and use AWS Resource Access Manager (RAM) to share resources.

Question 2

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to ensure that all IAM users and roles across all accounts are required to use multi-factor authentication (MFA) when performing sensitive actions, such as deleting S3 buckets or modifying IAM policies. They want to enforce this centrally with minimal administrative effort. Which solution should they implement?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny sensitive actions unless the request is made with MFA.. Service control policies (SCPs) in AWS Organizations provide centralized control over permissions across all accounts. An SCP that denies sensitive actions unless MFA is present (using the aws:MultiFactorAuthPresent condition) enforces the requirement for all IAM users and roles in member accounts. This is the most efficient and consistent solution.

Answer

Configure AWS IAM Identity Center to require MFA for all users, and disable IAM users in all accounts.

Answer

Enable MFA requirement in the AWS Organizations management account settings, which automatically applies to all member accounts.

Answer

Create an IAM policy in each account that denies sensitive actions unless MFA is present, and attach it to all users and roles.

Question 3

A healthcare company operates a multi-account AWS environment managed by AWS Organizations. They have a central IT account that manages all VPCs and a separate security account for auditing. The company must ensure that all VPC Flow Logs from every account are delivered to a single Amazon S3 bucket in the security account, and that no account administrator can disable or alter the flow log configuration. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Enable VPC Flow Logs centrally using AWS Organizations and a service control policy that enforces flow logs, with the S3 bucket in the security account as the destination. Deny ec2:DeleteFlowLogs and ec2:ModifyFlowLogAttribute in the SCP.. Centralized enforcement of VPC Flow Logs across an organization is best achieved with AWS Organizations service control policies that deny disabling actions and mandate flow log creation. This provides preventive control with minimal per-account overhead, ensuring logs flow to the central security account S3 bucket.

Answer

Configure AWS Config rules in each account to detect disabled flow logs and use AWS Lambda to re-enable them automatically. Store logs in the security account S3 bucket.

Answer

Create an IAM role in each account that the security account can assume to manage flow logs, and use AWS CloudTrail to monitor changes. Store logs in the security account S3 bucket.

Answer

Use AWS CloudFormation StackSets to deploy VPC Flow Logs in all accounts, with the S3 bucket in the security account as the destination. Apply an SCP that denies ec2:DeleteFlowLogs and ec2:ModifyFlowLogAttribute.

Question 4

A company has a multi-account AWS environment with a shared services VPC in a central networking account. Several workload accounts need to access a set of common services hosted in the shared VPC. The company wants to minimize management overhead and avoid VPC peering connections. Which solution should a solutions architect recommend?

Accepted Answer

Use AWS Transit Gateway to connect the shared services VPC and all workload VPCs, and share the transit gateway with workload accounts using AWS Resource Access Manager (RAM).. AWS Transit Gateway with AWS RAM sharing provides a scalable, hub-and-spoke network topology that connects the shared services VPC with multiple workload VPCs. It eliminates the need for a mesh of VPC peering connections, supports transitive routing, and centralizes management, making it the most efficient solution for this scenario.

Answer

Use AWS PrivateLink to create interface VPC endpoints in each workload VPC for each service in the shared services VPC.

Answer

Create VPC peering connections between the shared services VPC and each workload VPC, and use route tables to direct traffic.

Answer

Deploy a VPN appliance in the shared services VPC and establish AWS Site-to-Site VPN connections from each workload VPC.

Question 5

A media company has 40 AWS accounts under AWS Organizations. Each account has a VPC, and many VPCs use overlapping CIDR ranges inherited from an acquisition. The company wants a single egress point for internet traffic, centralized inspection of east-west traffic, and the ability to add accounts without re-addressing existing VPCs. Which architecture should the solutions architect propose?

Accepted Answer

Create a transit gateway in a network account, attach each VPC, and use AWS PrivateLink endpoints in the network account for shared services so overlapping CIDRs never need to route to each other.. A transit gateway in a dedicated network account provides hub-and-spoke connectivity, centralized egress through a NAT gateway, and inspection via a firewall appliance attached to the hub. Route tables on the transit gateway decide which attachments can reach which, so overlapping CIDRs do not break connectivity as long as paths are controlled deliberately. AWS PrivateLink publishes shared services without requiring address-unique routing between every VPC.

Answer

Use AWS Site-to-Site VPN connections between every pair of VPCs and advertise routes with BGP so overlapping prefixes are resolved by longest-prefix match.

Answer

Build a full mesh of VPC peering connections between all 40 VPCs and route all egress traffic through a NAT gateway in the network account.

Answer

Deploy an AWS Transit Gateway in each account and peer the transit gateways together, then route all internet egress through a NAT gateway in the network account.

Question 6

A healthcare company runs a multi-account AWS Organization with a central networking account. Each of 40 workload VPCs connects to a Transit Gateway in the networking account using a Transit Gateway attachment in the workload account. The security team must allow only traffic from an approved list of CIDR ranges, must keep traffic on the AWS global network, and must not require workload teams to manage route tables in their own VPCs. Which design meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall in a centralized inspection VPC, route all inter-VPC traffic through the inspection VPC via the Transit Gateway, and use stateless and stateful rule groups to permit only the approved CIDRs.. A centralized inspection VPC anchored by AWS Network Firewall, reached through the Transit Gateway, satisfies all three constraints at once: traffic stays on the AWS global network, the CIDR allow list is enforced by firewall rule groups, and workload teams do not manage route tables because the TGW route tables and inspection VPC own the routing logic.

Answer

Use VPC peering between each workload VPC and a central inspection VPC, and apply security group references to restrict traffic to the approved CIDRs.

Answer

Attach each workload VPC to the Transit Gateway and use a Transit Gateway route table with a blackhole route for every CIDR outside the approved list, then share the route table with workload accounts.

Answer

Share the Transit Gateway with AWS Resource Access Manager and create a Transit Gateway route table in the networking account that references the shared attachments, then associate the workload VPC attachments with that route table.

Question 7

A company has a multi-account AWS environment with AWS Organizations. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. They want to ensure that only specific IAM roles in member accounts can assume roles in the security account, and that this configuration is consistent across all accounts. Which solution should a solutions architect recommend?

Accepted Answer

Create an IAM role in the security account with a trust policy that allows assumption by the organization ID using the aws:PrincipalOrgID condition, and use an SCP to restrict which roles in member accounts can assume it.. The correct solution is to create a role in the security account with a trust policy that includes the aws:PrincipalOrgID condition to allow assumption by principals in the organization, and then use an SCP to restrict which specific roles in member accounts can call sts:AssumeRole. This centralizes control, ensures consistency, and scales across all accounts without per-account trust policy management.

Answer

Use AWS IAM Identity Center to create a permission set that grants access to the security account, and assign it to users or groups in the member accounts.

Answer

Create an IAM role in the security account with a trust policy that allows assumption by a specific IAM role in each member account, and use AWS CloudFormation StackSets to deploy the roles across all accounts.

Answer

Create an IAM role in each member account that has a trust policy allowing the security account to assume it, and then have the security account assume those roles to perform actions.

Question 8

A company has a multi-account AWS environment with a shared services account that hosts Active Directory. They want to allow users in all accounts to authenticate to AWS using their existing Active Directory credentials. They also want to assign permissions based on Active Directory groups. Which solution should they implement?

Accepted Answer

Use AWS IAM Identity Center with an external identity provider (IdP) that supports SCIM, such as Azure AD, to synchronize users and groups and assign permissions.. AWS IAM Identity Center integrates with external identity providers that support SCIM, such as Microsoft Entra ID, to synchronize users and groups. It enables centralized permission assignment based on AD groups and automatically provisions IAM roles in all accounts. This provides a scalable and manageable solution for multi-account environments.

Answer

Create IAM users in each account and synchronize passwords with Active Directory using a custom Lambda function.

Answer

Deploy AWS Managed Microsoft AD in the shared services account and configure trust relationships with all other accounts' VPCs.

Answer

Set up SAML federation between AWS IAM and Active Directory Federation Services (AD FS), and create IAM roles for each AD group.

Question 9

A company has a multi-account AWS environment with a shared services account that hosts a centralized Amazon RDS for MySQL database. Workload accounts need to access this database. The security team requires that all connections to the database be encrypted in transit and that access be limited to specific IAM roles. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Use AWS PrivateLink to create an interface VPC endpoint for the RDS database in the shared services VPC, and have workload accounts connect via the endpoint. Enable SSL/TLS on the RDS instance and use IAM database authentication.. AWS PrivateLink allows workload VPCs to access the RDS database privately through interface VPC endpoints, avoiding complex peering or VPN configurations. Enabling SSL/TLS ensures encryption in transit, and IAM database authentication limits access to authorized IAM roles. This combination provides a secure, scalable, and low-maintenance solution for cross-account database access.

Answer

Create a VPC peering connection between each workload VPC and the shared services VPC, and configure security groups to allow traffic from the workload VPC CIDR ranges. Use IAM database authentication for access control.

Answer

Expose the RDS database publicly and use security groups to restrict access to specific IP addresses. Enable SSL/TLS and use IAM database authentication.

Answer

Set up an AWS Site-to-Site VPN connection between each workload VPC and the shared services VPC, and configure the RDS instance to require SSL. Use IAM database authentication for access control.

Question 10

A global retailer runs workloads in us-east-1, eu-west-1, and ap-southeast-1 under a single AWS Organizations management account. The finance team needs a consolidated view of costs by business unit that maps to specific accounts, and the security team requires that only the finance account can view cost and usage data. The company also wants to receive alerts when any business unit exceeds its monthly budget. Which combination of steps should the solutions architect take?

Accepted Answer

Activate the business unit cost allocation tags, configure a Cost Category that groups accounts by business unit, deliver the AWS Cost and Usage Report to an S3 bucket in the finance account, and create AWS Budgets with alert thresholds in the management account.. Cost allocation tags activated in the management account provide the grouping dimension, and a Cost Category maps accounts to business units so the consolidated view matches how the company operates. Sending the Cost and Usage Report to a bucket in the finance account limits who can inspect detailed usage, while AWS Budgets created in the management account watch the aggregated spend and raise alerts when a business unit passes its threshold.

Answer

Enable AWS Cost Explorer in the finance account, attach a service control policy denying ce:GetCostAndUsage to all other accounts, and create a budget per account in the management account.

Answer

Create a Cost Category in each member account, enable the AWS Billing and Cost Management console for the finance account, and configure AWS Budgets in every member account with the same threshold.

Answer

Activate the cost allocation tags for business unit in the management account, create a billing concurrency setup in the management account, and share the AWS Cost and Usage Report with the finance account through AWS Resource Access Manager.

Question 11

A multinational enterprise uses AWS Organizations with a central networking account and 50 workload accounts. They have deployed AWS Transit Gateway in the networking account and shared it with all workload accounts via AWS Resource Access Manager (RAM). The security team wants to ensure that all inter-VPC traffic between workload accounts is inspected by a central firewall appliance in the networking account. They also want to prevent workload accounts from creating their own Transit Gateway attachments that bypass the inspection VPC. Which two actions should the solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure Transit Gateway route tables in the networking account to route all inter-VPC traffic through the inspection VPC's attachment, and associate workload VPC attachments with a route table that has a default route to the inspection VPC.. The combination of an SCP that denies Transit Gateway VPC attachments in workload accounts and Transit Gateway route tables that force traffic through the inspection VPC ensures that all inter-VPC traffic is inspected and cannot bypass the firewall. These two controls work together to enforce the security requirement.

Answer

Create a VPC peering connection between each workload VPC and the inspection VPC, and remove the Transit Gateway share from workload accounts.

Answer

Enable AWS Transit Gateway inter-region peering between all workload accounts and the networking account, and use AWS Network Firewall in the inspection VPC.

Answer

Use AWS PrivateLink to create endpoint services in the inspection VPC, and have workload accounts connect to those endpoints for all inter-VPC communication.

Question 12

A media company has a multi-account organization with a shared services account that hosts a centralized Amazon EFS file system. Application accounts in three different Regions must access the file system over private connectivity only, and the security team wants to ensure that no traffic leaves the AWS network and that each application account can access only its own access point. Which solution should the solutions architect recommend?

Accepted Answer

Share the EFS file system using AWS Resource Access Manager and create a VPC endpoint for EFS in each application VPC, then use an EFS file system policy that allows each account only through its own access point.. Sharing the file system with Resource Access Manager plus an EFS interface endpoint in each application VPC is what allows cross-account, cross-Region mounts that stay entirely on the AWS network. A file system policy referencing each account and its dedicated access point delivers the per-account isolation the security team requires.

Answer

Create a VPC peering connection from each application VPC to the shared services VPC, mount the EFS file system using its DNS name, and rely on EFS access points to enforce per-account isolation.

Answer

Create an AWS Site-to-Site VPN between each application VPC and the shared services VPC and mount the file system using the private IP addresses returned by the EFS mount target ENIs.

Answer

Mount the EFS file system over the public EFS endpoint from each application account and use security groups to restrict source IPs to the application VPC CIDR ranges.

Question 13

A company has a multi-account AWS environment with AWS Organizations. They want to centrally manage DNS records for all accounts using Amazon Route 53. Each account needs to create and manage its own DNS records for its own domain, but the security team wants to prevent accounts from modifying records outside their delegated zone. What is the MOST efficient way to achieve this?

Accepted Answer

Create a public hosted zone in the central account for the parent domain, and use Route 53 delegation to create subdomains in each account with NS records pointing to the subdomain hosted zones.. The most efficient and scalable method is to use DNS delegation. The central account owns the parent domain and creates NS records that delegate subdomains to hosted zones in each account. This allows each account to manage its own DNS records independently while the central account retains control over the delegation. It avoids cross-account access issues and aligns with AWS best practices.

Answer

Create a private hosted zone in each account and associate it with all VPCs in the organization using AWS CloudFormation StackSets.

Answer

Create a separate public hosted zone in each account for its domain, and use AWS Resource Access Manager (RAM) to share the hosted zone with the central account.

Answer

Use AWS Organizations to create a service control policy (SCP) that allows only the central account to modify Route 53 records, and have all accounts use the central account's hosted zone.

Question 14

A company is using AWS Organizations with consolidated billing. The finance team wants to allocate AWS costs to different departments and projects. They need to ensure that each department can only see and manage their own resources, and that costs are automatically tagged for chargeback. The company has multiple AWS accounts per department. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies s3:PutBucketEncryption if the encryption algorithm is not aws:kms, and attach it to the root of the organization.. To enforce SSE-KMS with CMKs in a central account, you need both a preventive control and cross-account key access. An SCP that denies s3:PutBucketEncryption unless aws:kms is used prevents non-compliant encryption settings. A KMS key policy in the central security account that grants usage to member accounts allows those accounts to use the CMK for encryption, centralizing key management and meeting the requirements.

Answer

Enable S3 default encryption at the organization level using AWS Organizations and S3 Block Public Access settings.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to all existing and future accounts that denies uploads without encryption headers.

Answer

Create an AWS Config rule in each member account that checks for S3 bucket encryption and automatically remediates non-compliant buckets using an AWS Lambda function.

Question 15

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.