SAP-C02 Design Solutions for Organizational Complexity Practice Test 26 — 15 Questions

Question 1

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

Accepted Answer

Enable Security Hub in the central account and invite member accounts to enable Security Hub.. Option D is correct because AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Answer

Set up Amazon EventBridge to forward findings from each account to the central account.

Answer

Use Amazon CloudWatch cross-account dashboards to view findings.

Answer

Enable AWS Config aggregator in the central account.

Question 2

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

Accepted Answer

Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.. Option A is correct because the IAM policy condition 'ec2:RequestTag/CostCenter' ensures that the developer's RunInstances request includes the required 'CostCenter' tag, enforcing tagging compliance at launch time. Option B is correct because a condition using 'ec2:InstanceType' with a 'ForAllValues:StringLike' or 'StringEquals' operator restricts allowed instance types to a specific list, preventing unauthorized instance families or sizes.

Answer

Allow ec2:RunInstances without conditions.

Answer

Deny ec2:RunInstances if the instance type is not in the allowed list.

Question 3

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Accepted Answer

Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.. Option B is correct because restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.

Answer

Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.

Answer

Create a VPC peering connection between the central account and each VPC.

Question 4

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

Accepted Answer

The write is allowed because the policy grants access to the root of account 123456789012.. The S3 bucket policy grants access to the root user of account 123456789012 (the `Principal` is the AWS account root user via the account ARN). When a service in that account writes to the bucket, the request is made on behalf of the account, and the root user effectively owns all identities in the account. The policy allows `s3:PutObject` on the `AWSLogs/123456789012/*` prefix, so the write to `s3://my-log-bucket/AWSLogs/123456789012/logfile.txt` is permitted. Option B correctly identifies that the root user grant covers the service's action.

Answer

The write is denied because the principal is the root user, not an IAM role.

Answer

The write is denied because the policy only allows GetObject, not PutObject.

Answer

The write is allowed only if the object key is exactly 'AWSLogs/123456789012/'.

Question 5

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

Accepted Answer

Enable AWS CloudTrail in the master account and log sts:AssumeRole events.. Option A is correct because AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Answer

Create an IAM Access Analyzer in each member account to monitor cross-account access.

Answer

Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

Answer

Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.

Question 6

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

Accepted Answer

Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.. AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Answer

Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

Answer

Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

Answer

Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

Question 7

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

Accepted Answer

Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.. Option A is correct because SCPs can be attached to the root or OUs to deny actions in unapproved Regions. Option B is wrong because IAM policies can be attached to users/roles but not to OUs. Option C is wrong because resource-based policies are attached to individual resources. Option D is wrong because CloudTrail trails only log events, not enforce policies.

Answer

Create a resource-based policy on each resource type that denies creation in unapproved Regions.

Answer

Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

Answer

Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

Question 8

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

Accepted Answer

Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.. Option A is correct because deploying the pipeline in a central DevOps account and using cross-account IAM roles to deploy to target accounts follows the principle of least privilege and centralizes management. This approach avoids duplicating resources, ensures a single source of truth for the source repository and artifact store, and scales easily as new accounts are added via AWS Control Tower. Cross-account IAM roles allow the pipeline to assume a role in each target account with scoped permissions, eliminating the need for long-term credentials.

Answer

Create a separate pipeline in each account using the same source repository.

Question 9

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

Accepted Answer

The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.. The bucket policy explicitly grants access to the member account's root user ARN (e.g., `arn:aws:iam::123456789012:root`). When a developer assumes an IAM role in the member account, the resulting session has a different ARN (e.g., `arn:aws:sts::123456789012:assumed-role/DevRole/session`). Because the bucket policy's Principal is restricted to the root user ARN, the role session is not recognized as a matching principal, and access is denied. This is a common misconfiguration when mixing root user grants with assumed-role access.

Answer

The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.

Answer

The bucket policy requires an explicit Deny for all principals except the root user.

Answer

A service control policy (SCP) is denying access to the S3 bucket.

Question 10

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

Accepted Answer

AWS Control Tower and Service Control Policies (SCPs).. AWS Control Tower provides a managed service to automate the creation of new AWS accounts through Account Factory, while Service Control Policies (SCPs) enforce baseline security guardrails across all accounts in the organization. This combination ensures that every new account is provisioned with consistent security policies without manual intervention.

Answer

AWS Service Catalog and AWS Config.

Answer

AWS Organizations API and CloudTrail.

Answer

AWS CloudFormation StackSets and IAM.

Question 11

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

Accepted Answer

Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.. Option B is correct because AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Answer

Use S3 access points in each account to grant access to the central bucket.

Answer

Create an S3 interface endpoint in the logging account and share it with other accounts.

Answer

Copy logs to each account's own S3 bucket and run Athena queries locally.

Question 12

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

Accepted Answer

Attach a service control policy (SCP) that denies sts:AssumeRole if the aws:PrincipalOrgID condition is not set.. Option D is correct because a service control policy (SCP) can centrally enforce that all IAM role trust policies in member accounts require the `aws:PrincipalOrgID` condition key. This condition ensures that only principals within the organization can assume roles, blocking any external user from assuming a role even if the role's trust policy is misconfigured. SCPs apply to all accounts in an OU or organization, providing a preventive control that cannot be overridden by account administrators.

Answer

Enable AWS CloudTrail to log role assumptions and send alerts when external assumptions occur.

Answer

Use AWS Config to detect roles with external trust relationships and automatically delete them.

Answer

Modify the trust policy of each IAM role to allow only principals from the organization.

Question 13

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

Accepted Answer

AWS IAM Identity Center.. AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

Amazon Cognito user pools.

Answer

AWS Identity and Access Management (IAM) with SAML federation.

Question 14

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.. Option A is correct because a service control policy (SCP) can be applied at the AWS Organizations root, OU, or account level to deny S3 bucket operations that do not include encryption. By using a condition key like `s3:x-amz-server-side-encryption` in the SCP, you can enforce that any `s3:PutBucket*` action must specify encryption, preventing the creation or modification of buckets without SSE. This provides a preventive, centralized control that cannot be overridden by account administrators.

Answer

Set the default encryption on each bucket to disable encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.

Answer

Create an IAM policy with a global condition for SSE and attach it to all users and roles.

Question 15

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Accepted Answer

Attach the VPCs in member accounts to the transit gateway.. Option A is correct because attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.

Answer

Create VPC endpoints for the transit gateway in each VPC.

Answer

Create VPC peering connections between each VPC and the networking VPC.