SAP-C02 Design Solutions for Organizational Complexity Practice Test 25 — 15 Questions

Question 1

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

Accepted Answer

Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.. AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Answer

Use AWS Organizations service control policies to deny cross-account access.

Answer

Use AWS Trusted Advisor to check for unused cross-account roles.

Answer

Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

Question 2

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon S3 Select to retrieve only the relevant log entries based on the IP address and time range.. Amazon S3 Select allows you to retrieve only a subset of data from an object using SQL expressions, making it highly cost-effective for scanning large log files for specific IP addresses and time ranges. It reduces the amount of data transferred and processed compared to reading the entire object, and it scales automatically without provisioning any infrastructure. This approach is ideal for ad-hoc queries on structured or semi-structured log data stored in S3.

Answer

Use Amazon Athena to query the logs directly in S3.

Answer

Stream the logs to Amazon OpenSearch Service for real-time querying.

Answer

Use AWS Glue to catalog the logs and query with Amazon Redshift Spectrum.

Question 3

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 4

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 5

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

Accepted Answer

Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.. AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Answer

Use an SCP that denies all IAM actions except those from a specific admin account.

Answer

Use an IAM password policy that requires multi-factor authentication for all users.

Answer

Create an IAM role in each account with full administrator access and use a break-glass process to assume it.

Question 6

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Answer

Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

Answer

Manually enable CloudTrail in each account by logging into every account.

Answer

Create an SCP that requires CloudTrail to be enabled in each account.

Question 7

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Accepted Answer

Create an SCP that denies s3:PutObject unless encryption headers are included.. An SCP can deny the s3:PutObject action unless encryption headers are included, using the condition key s3:x-amz-server-side-encryption. This enforces server-side encryption on all object uploads across the organization. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable it, ensuring compliance. Option C is incorrect because S3 Block Public Access does not enforce encryption; it only prevents public access. Option B is incorrect because SCPs cannot 'require' encryption in the sense of enabling it; they can only deny non-compliant requests, making Option A the precise action. Option D is incorrect because denying CreateBucket does not enforce encryption on existing buckets.

Answer

Create an SCP that requires all objects to be uploaded with server-side encryption.

Answer

Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.

Answer

Create an SCP that denies the s3:CreateBucket action to all accounts.

Question 8

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.. Deploying a centralized inspection VPC with AWS Network Firewall and using Transit Gateway to route traffic allows the company to centralize network administration and enforce common security rules across all VPCs. Transit Gateway acts as a hub for inter-VPC and on-premises connectivity, while AWS Network Firewall provides stateful inspection and filtering for all traffic passing through the hub, meeting the requirement for a common set of security rules.

Answer

Allow each team to create their own VPCs and use VPC Peering to connect them.

Answer

Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

Question 9

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Accepted Answer

Use AWS Resource Access Manager to share resources only with trusted accounts.. AWS Resource Access Manager (RAM) enables you to share resources such as subnets, transit gateways, and License Manager configurations only with specific AWS accounts or organizational units, which directly supports a data perimeter by preventing unintended cross-account access. Option C is correct because Service Control Policies (SCPs) can be applied at the organization root, OU, or account level to deny access to external AWS accounts unless explicitly allowed, effectively creating a boundary that prevents data exfiltration to unauthorized accounts.

Answer

Disable public access to all S3 buckets and restrict cross-account access.

Answer

Use VPC endpoints for all AWS services and ensure they are private.

Answer

Use security groups to restrict outbound traffic to known IP addresses.

Question 10

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

Accepted Answer

Use AWS Config rules in each account to detect non-compliant buckets and trigger auto-remediation.. Using AWS Config rules deployed via StackSets across all accounts in the organization provides a scalable and maintainable way to detect non-compliant buckets (e.g., those without SSE-KMS encryption) and trigger auto-remediation to enforce encryption. This approach is proactive and centralized, while still being scalable via AWS Organizations. Option A is incorrect because the SCP actions mentioned (s3:PutBucketAcl and s3:PutBucketPolicy) do not control encryption settings. Option B is only detective and does not enforce compliance. Option D does not address encryption enforcement.

Answer

Apply a service control policy (SCP) at the root OU that denies s3:PutBucketAcl or s3:PutBucketPolicy actions unless encryption is configured.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the security team.

Answer

Create a CloudFormation StackSet that deploys an S3 bucket policy in every account.

Question 11

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

Accepted Answer

Use AWS Cost Categories to group costs by tag value and set a default rule for untagged resources.. AWS Cost Categories allow you to group costs by tag values and, crucially, set a default rule for untagged resources. This ensures that all resources—tagged or not—are assigned to a cost center, providing the most accurate cost allocation across the entire organization. Other options only filter or report on tagged resources, leaving untagged costs unallocated.

Answer

Enable cost allocation tags and use AWS Cost Explorer to filter by tag.

Answer

Create AWS Budgets reports for each cost center using tag filters.

Answer

Export AWS Cost and Usage Reports to Amazon QuickSight and use tag-based filtering.

Question 12

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

Accepted Answer

Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.. Using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.

Answer

Allow s3:GetObject to the SIEM's IAM role.

Answer

Use an S3 access point with a network origin policy.

Answer

Allow s3:GetObject to the SIEM's AWS account ID.

Question 13

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.. AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Answer

Manually enable Shield Advanced in each account after creation.

Answer

Use AWS Config to detect accounts without Shield Advanced and send notifications.

Answer

Use AWS Organizations to create an SCP that requires Shield Advanced.

Question 14

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

Accepted Answer

Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.. Using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect VPCs to the shared services VPC.

Answer

Use a single TGW route table for all attachments and control traffic with security groups.

Question 15

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

Accepted Answer

Configure CloudTrail in each account to deliver logs to a single S3 bucket in the security account.. CloudTrail can be configured in each account to deliver log files to a centralized S3 bucket in the security account. This approach aggregates all IAM user activities into a single location without requiring additional streaming infrastructure, and it scales automatically as new accounts are added. The central security team can then use Amazon Athena or AWS Lake Formation to query the logs across all accounts efficiently.

Answer

Enable CloudTrail Insights in each account and review separately.

Answer

Use AWS Config aggregator to collect IAM user activity.

Answer

Set up Amazon Kinesis Data Streams in each account and stream to a central Kinesis Data Firehose.