SAP-C02 Design Solutions for Organizational Complexity Practice Test 26 — 15 Questions

Question 1

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Share the approved AMIs from the central account with all other accounts.. Sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.

Answer

Use AWS CloudFormation Guard to validate templates before deployment.

Answer

Use AWS Service Catalog to create a product for approved AMIs.

Question 2

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.. AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Answer

Use AWS Single Sign-On (SSO) to grant the audit team access to each account.

Answer

Create an IAM user in the audit account and allow that user to assume a role in each account.

Answer

Manually create an IAM role in each account and attach a read-only policy.

Question 3

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Answer

AWS Config

Answer

Amazon ECS

Answer

AWS OpsWorks

Question 4

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 5

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies any instance type not in the allowed list.. The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.

Answer

The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.

Answer

The instance launch is denied, but only if the account's IAM policy also denies it.

Answer

The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.

Question 6

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

Accepted Answer

Enable Security Hub in the central account and invite member accounts to enable Security Hub.. AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Answer

Set up Amazon EventBridge to forward findings from each account to the central account.

Answer

Use Amazon CloudWatch cross-account dashboards to view findings.

Answer

Enable AWS Config aggregator in the central account.

Question 7

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

Accepted Answer

Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.. The IAM policy condition 'ec2:RequestTag/CostCenter' ensures that the developer's RunInstances request includes the required 'CostCenter' tag, enforcing tagging compliance at launch time. Option B is correct because a condition using 'ec2:InstanceType' with a 'ForAllValues:StringLike' or 'StringEquals' operator restricts allowed instance types to a specific list, preventing unauthorized instance families or sizes.

Answer

Allow ec2:RunInstances without conditions.

Answer

Deny ec2:RunInstances if the instance type is not in the allowed list.

Question 8

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Accepted Answer

Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.. Restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.

Answer

Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.

Answer

Create a VPC peering connection between the central account and each VPC.

Question 9

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

Accepted Answer

The write is allowed because the policy grants access to the root of account 123456789012.. The S3 bucket policy grants access to the root user of account 123456789012 (the `Principal` is the AWS account root user via the account ARN). When a service in that account writes to the bucket, the request is made on behalf of the account, and the root user effectively owns all identities in the account. The policy allows `s3:PutObject` on the `AWSLogs/123456789012/*` prefix, so the write to `s3://my-log-bucket/AWSLogs/123456789012/logfile.txt` is permitted. Option B correctly identifies that the root user grant covers the service's action.

Answer

The write is denied because the principal is the root user, not an IAM role.

Answer

The write is denied because the policy only allows GetObject, not PutObject.

Answer

The write is allowed only if the object key is exactly 'AWSLogs/123456789012/'.

Question 10

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

Accepted Answer

Enable AWS CloudTrail in the master account and log sts:AssumeRole events.. AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Answer

Create an IAM Access Analyzer in each member account to monitor cross-account access.

Answer

Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

Answer

Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.

Question 11

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

Accepted Answer

Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.. AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Answer

Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

Answer

Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

Answer

Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

Question 12

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

Accepted Answer

Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.. Service control policies (SCPs) are the correct mechanism to centrally restrict AWS service actions across all accounts in an AWS Organization. By attaching an SCP that denies actions in unapproved Regions to the root or OUs, the security team ensures that no principal (including the root user) can create resources outside the allowed Regions, regardless of any IAM policies attached at the account level.

Answer

Create a resource-based policy on each resource type that denies creation in unapproved Regions.

Answer

Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

Answer

Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

Question 13

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

Accepted Answer

Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.. The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity. Therefore, only Option A fully meets the requirements.

Answer

Create a separate pipeline in each account using the same source repository.

Answer

Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.

Question 14

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

Accepted Answer

The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.. The bucket policy explicitly grants access to the member account's root user ARN (e.g., `arn:aws:iam::123456789012:root`). When a developer assumes an IAM role in the member account, the resulting session has a different ARN (e.g., `arn:aws:sts::123456789012:assumed-role/DevRole/session`). Because the bucket policy's Principal is restricted to the root user ARN, the role session is not recognized as a matching principal, and access is denied. This is a common misconfiguration when mixing root user grants with assumed-role access.

Answer

The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.

Answer

The bucket policy requires an explicit Deny for all principals except the root user.

Answer

A service control policy (SCP) is denying access to the S3 bucket.

Question 15

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

Accepted Answer

AWS Control Tower and Service Control Policies (SCPs).. AWS Control Tower provides a managed service to automate the creation of new AWS accounts through Account Factory, while Service Control Policies (SCPs) enforce baseline security guardrails across all accounts in the organization. This combination ensures that every new account is provisioned with consistent security policies without manual intervention.

Answer

AWS Service Catalog and AWS Config.

Answer

AWS Organizations API and CloudTrail.

Answer

AWS CloudFormation StackSets and IAM.