SAP-C02 Design Solutions for Organizational Complexity Practice Test 26 — 15 Questions

Question 1

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.. AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Answer

Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

Answer

Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

Answer

Use an SCP to require CloudTrail to be enabled in each account.

Question 2

Refer to the exhibit. A company runs the AWS CLI command to list accounts in AWS Organizations. The company wants to remove the account '444444444444' from the organization. What must the company do first before it can remove this account?

Accepted Answer

Close the AWS account from the management account.. To remove a member account that was created within AWS Organizations, the management account must first close the account. This is a prerequisite because accounts created via Organizations cannot be removed directly; only invited accounts can be removed without closing. Closing the account suspends it; after closure, the management account can then remove it from the organization. The account remains closed and is not converted into an active standalone account.

Answer

Create a support ticket to AWS to remove the account.

Answer

Remove the account's payment method.

Answer

The management account can directly remove the account without any prerequisites.

Question 3

A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?

Accepted Answer

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.. It uses cross-Region transit gateway peering, which allows VPCs in different Regions to communicate through their respective transit gateways. By attaching both VPCs to their local transit gateways and peering those gateways, you can configure route tables to force AD traffic through the inspection VPC in one Region, satisfying the firewall inspection requirement. Option D is incorrect because you cannot attach a VPC in a secondary Region to a transit gateway in the primary Region; transit gateway attachments are regional.

Answer

Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.

Answer

Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.

Answer

Deploy AD in two Regions, attach both VPCs to a transit gateway in the primary Region, and use a transit gateway inter-Region peering attachment. Configure route tables to force traffic through the inspection VPC in the primary Region.

Question 4

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.. It uses AWS Config rules to detect noncompliant S3 buckets (e.g., missing versioning or KMS encryption) and triggers an automated Lambda remediation to enable versioning and encryption. This ensures compliance with minimal manual intervention, though it does incur some operational overhead for Lambda maintenance. Option A is incorrect because SCPs cannot enforce versioning at bucket creation—versioning is enabled after creation via PutBucketVersioning, and the headers mentioned in the explanation do not exist. Option B only alerts and does not enforce. Option C is not scalable for OU-level enforcement and can be bypassed.

Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Question 5

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

Accepted Answer

Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.. It combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Answer

Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

Answer

Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

Answer

Use AWS Trusted Advisor to check for root user usage and generate a weekly report.

Question 6

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Accepted Answer

Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.. Establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Answer

Configure an IAM identity provider to use the on-premises Active Directory.

Answer

Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

Answer

Deploy AWS Managed Microsoft AD in each account and configure replication.

Question 7

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Accepted Answer

Step 1: Create virtual interface in AWS, Step 2: Configure on-premises router, Step 3: Establish BGP session, Step 4: Verify interface availability, Step 5: Update route tables. The correct order is: first create the virtual interface in AWS, then configure the on-premises router, establish BGP, verify availability, and finally update route tables.

Answer

Step 1: Configure on-premises router, Step 2: Create virtual interface in AWS, Step 3: Establish BGP session, Step 4: Verify interface availability, Step 5: Update route tables

Answer

Step 1: Create virtual interface in AWS, Step 2: Establish BGP session, Step 3: Configure on-premises router, Step 4: Verify interface availability, Step 5: Update route tables

Answer

Step 1: Create virtual interface in AWS, Step 2: Configure on-premises router, Step 3: Update route tables, Step 4: Establish BGP session, Step 5: Verify interface availability

Question 8

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Accepted Answer

1. Navigate to snapshots, 2. Restore, 3. Configure settings, 4. Wait for completion, 5. Update application endpoint. First navigate to snapshots, restore, configure settings, wait for completion, then update application endpoint.

Answer

1. Configure settings, 2. Restore, 3. Navigate to snapshots, 4. Wait for completion, 5. Update application endpoint

Answer

1. Navigate to snapshots, 2. Restore, 3. Update application endpoint, 4. Wait for completion, 5. Configure settings

Answer

1. Restore, 2. Navigate to snapshots, 3. Configure settings, 4. Wait for completion, 5. Update application endpoint

Question 9

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

Accepted Answer

Create an S3 bucket, then create the trail, then configure events, then enable security features, then verify delivery.. First create the S3 bucket, then create the trail, configure events, enable security features, and verify delivery.

Answer

Create the trail, then configure events, then create an S3 bucket, then enable security features, then verify delivery.

Answer

Create an S3 bucket, then create the trail, then enable security features, then configure events, then verify delivery.

Answer

Create an S3 bucket, then configure events, then create the trail, then enable security features, then verify delivery.

Question 10

Match each AWS service to its primary use case.

Accepted Answer

AWS Organizations: Centrally manage multiple AWS accounts and consolidate billing. Correct matches: AWS Organizations for account management, AWS Direct Connect for dedicated private connection, AWS VPN for encrypted internet connection, AWS Transit Gateway for hub-and-spoke network interconnection. Common confusions include swapping Direct Connect and VPN, or misattributing account management to networking services.

Answer

AWS Organizations: Dedicated private network connection from on-premises to AWS

Answer

AWS Direct Connect: Secure encrypted connection over the public internet to AWS

Question 11

Match each AWS migration service to its function.

Accepted Answer

AWS Migration Hub: Centralized tracking of migration progress. AWS Migration Hub centralizes tracking, SMS automates server replication, DMS handles database migration, and Application Discovery Service discovers on-premises assets.

Answer

AWS Migration Hub: Migrates databases to AWS with minimal downtime

Answer

AWS Server Migration Service: Discovers on-premises applications and dependencies

Question 12

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.. AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.

Answer

Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.

Answer

Use AWS Systems Manager Automation to apply the baseline to new accounts.

Answer

Use AWS Config aggregators to apply the baseline controls to new accounts.

Question 13

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

Accepted Answer

Use AWS Organizations to register the member account as a delegated administrator for the service.. AWS Organizations allows you to designate a member account as a delegated administrator for a specific AWS service. Once registered, that account can perform administrative actions (e.g., creating resources, managing policies) across all accounts in the organization on behalf of that service, without needing individual IAM roles or permissions in each account.

Answer

Create a service-linked role in each account to allow the service to perform actions.

Answer

Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.

Answer

Create an IAM role in each account with a trust policy that allows the service to assume it.

Question 14

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

Accepted Answer

Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.. A Service Control Policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the ec2:RunInstances action unless the request includes the required 'CostCenter' tag. This enforces the tagging requirement across all accounts in the organization without needing per-account IAM policies, and it cannot be overridden by account administrators.

Answer

Create an IAM policy in each account that requires the tag for ec2:RunInstances.

Answer

Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

Answer

Configure the EC2 service to automatically add the tag to all instances.

Question 15

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.. Option D is correct because creating an organization trail from the management account with 'Enable for all accounts in my organization' is the mechanism that makes CloudTrail log events from every member account into the specified S3 bucket, satisfying the centralized logging requirement. Option E is correct because the central S3 bucket must have a bucket policy granting the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, and it must account for the source accounts (via aws:SourceArn or organization conditions) so logs from all accounts can be delivered. Option A is not required because S3 replication copies objects between buckets and is unrelated to CloudTrail's native organization trail delivery. Option B is not required because CloudTrail uses the service principal and bucket policy, not an IAM role in each member account, to deliver logs. Option C is not required because AWS Config records resource configuration changes and does not forward CloudTrail logs to S3.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.