SAP-C02 Design Solutions for Organizational Complexity Practice Test 25 — 15 Questions

Question 1

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. Option C is correct because AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Answer

Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

Answer

Manually enable CloudTrail in each account by logging into every account.

Answer

Create an SCP that requires CloudTrail to be enabled in each account.

Question 2

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.. Option C is correct because enabling S3 Block Public Access at the account level prevents any public access to S3 buckets, and using a service control policy (SCP) to deny actions that would disable this setting ensures it cannot be overridden by any account in the organization. This enforces encryption indirectly by ensuring that all buckets are private, but the primary requirement is encryption; however, the question asks for two actions, and C combined with E provides a complete solution. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable encryption, ensuring compliance across all accounts.

Answer

Create an SCP that denies s3:PutObject unless encryption headers are included.

Answer

Create an SCP that requires all objects to be uploaded with server-side encryption.

Answer

Create an SCP that denies the s3:CreateBucket action to all accounts.

Question 3

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.. Option B is correct because deploying a centralized inspection VPC with AWS Network Firewall and using Transit Gateway to route traffic allows the company to centralize network administration and enforce common security rules across all VPCs. Transit Gateway acts as a hub for inter-VPC and on-premises connectivity, while AWS Network Firewall provides stateful inspection and filtering for all traffic passing through the hub, meeting the requirement for a common set of security rules.

Answer

Allow each team to create their own VPCs and use VPC Peering to connect them.

Answer

Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

Question 4

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Accepted Answer

Use AWS Resource Access Manager to share resources only with trusted accounts.. Option B is correct because AWS Resource Access Manager (RAM) enables you to share resources such as subnets, transit gateways, and License Manager configurations only with specific AWS accounts or organizational units, which directly supports a data perimeter by preventing unintended cross-account access. Option C is correct because Service Control Policies (SCPs) can be applied at the organization root, OU, or account level to deny access to external AWS accounts unless explicitly allowed, effectively creating a boundary that prevents data exfiltration to unauthorized accounts.

Answer

Disable public access to all S3 buckets and restrict cross-account access.

Answer

Use VPC endpoints for all AWS services and ensure they are private.

Answer

Use security groups to restrict outbound traffic to known IP addresses.

Question 5

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

Accepted Answer

Apply a service control policy (SCP) at the root OU that denies s3:PutBucketAcl or s3:PutBucketPolicy actions unless encryption is configured.. Option A is correct because an SCP applied at the root OU can deny any S3 PutBucketAcl or PutBucketPolicy action unless the request includes a condition that the bucket encryption uses a KMS key from the security team’s account. This approach is centralized, scales across all accounts automatically, and prevents non-compliant buckets from being created or modified, making it the most scalable and maintainable solution.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the security team.

Answer

Use AWS Config rules in each account to detect non-compliant buckets and trigger auto-remediation.

Answer

Create a CloudFormation StackSet that deploys an S3 bucket policy in every account.

Question 6

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

Accepted Answer

Use AWS Cost Categories to group costs by tag value and set a default rule for untagged resources.. Option D is correct because AWS Cost Categories allow you to group costs by tag values and, crucially, set a default rule for untagged resources. This ensures that all resources—tagged or not—are assigned to a cost center, providing the most accurate cost allocation across the entire organization. Other options only filter or report on tagged resources, leaving untagged costs unallocated.

Answer

Enable cost allocation tags and use AWS Cost Explorer to filter by tag.

Answer

Create AWS Budgets reports for each cost center using tag filters.

Answer

Export AWS Cost and Usage Reports to Amazon QuickSight and use tag-based filtering.

Question 7

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

Accepted Answer

Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.. Option C is correct because using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.

Answer

Allow s3:GetObject to the SIEM's IAM role.

Answer

Use an S3 access point with a network origin policy.

Answer

Allow s3:GetObject to the SIEM's AWS account ID.

Question 8

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.. AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Answer

Manually enable Shield Advanced in each account after creation.

Answer

Use AWS Config to detect accounts without Shield Advanced and send notifications.

Answer

Use AWS Organizations to create an SCP that requires Shield Advanced.

Question 9

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

Accepted Answer

Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.. Option D is correct because using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect VPCs to the shared services VPC.

Answer

Use a single TGW route table for all attachments and control traffic with security groups.

Question 10

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

Accepted Answer

Configure CloudTrail in each account to deliver logs to a single S3 bucket in the security account.. Option D is correct because CloudTrail can be configured in each account to deliver log files to a centralized S3 bucket in the security account. This approach aggregates all IAM user activities into a single location without requiring additional streaming infrastructure, and it scales automatically as new accounts are added. The central security team can then use Amazon Athena or AWS Lake Formation to query the logs across all accounts efficiently.

Answer

Enable CloudTrail Insights in each account and review separately.

Answer

Use AWS Config aggregator to collect IAM user activity.

Answer

Set up Amazon Kinesis Data Streams in each account and stream to a central Kinesis Data Firehose.

Question 11

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Share the approved AMIs from the central account with all other accounts.. Option A is correct because sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.

Answer

Use AWS CloudFormation Guard to validate templates before deployment.

Answer

Use AWS Service Catalog to create a product for approved AMIs.

Question 12

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.. Option D is correct because AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Answer

Use AWS Single Sign-On (SSO) to grant the audit team access to each account.

Answer

Create an IAM user in the audit account and allow that user to assume a role in each account.

Answer

Manually create an IAM role in each account and attach a read-only policy.

Question 13

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Answer

AWS Config

Answer

Amazon ECS

Answer

AWS OpsWorks

Question 14

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Option B is correct because Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 15

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies any instance type not in the allowed list.. The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.

Answer

The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.

Answer

The instance launch is denied, but only if the account's IAM policy also denies it.

Answer

The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.