SAP-C02 Design Solutions for Organizational Complexity Practice Test 27 — 15 Questions

Question 1

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.. AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Answer

Use S3 access points in each account to grant access to the central bucket.

Answer

Create an S3 interface endpoint in the logging account and share it with other accounts.

Answer

Copy logs to each account's own S3 bucket and run Athena queries locally.

Question 2

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

Accepted Answer

Attach a service control policy (SCP) that denies sts:AssumeRole if the aws:PrincipalOrgID condition is not set.. A service control policy (SCP) can centrally enforce that all IAM role trust policies in member accounts require the `aws:PrincipalOrgID` condition key. This condition ensures that only principals within the organization can assume roles, blocking any external user from assuming a role even if the role's trust policy is misconfigured. SCPs apply to all accounts in an OU or organization, providing a preventive control that cannot be overridden by account administrators.

Answer

Enable AWS CloudTrail to log role assumptions and send alerts when external assumptions occur.

Answer

Use AWS Config to detect roles with external trust relationships and automatically delete them.

Answer

Modify the trust policy of each IAM role to allow only principals from the organization.

Question 3

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

Accepted Answer

AWS IAM Identity Center.. AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

Amazon Cognito user pools.

Answer

AWS Identity and Access Management (IAM) with SAML federation.

Question 4

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.. A service control policy (SCP) can be applied at the AWS Organizations root, OU, or account level to deny S3 bucket operations that do not include encryption. By using a condition key like `s3:x-amz-server-side-encryption` in the SCP, you can enforce that any `s3:PutBucket*` action must specify encryption, preventing the creation or modification of buckets without SSE. This provides a preventive, centralized control that cannot be overridden by account administrators.

Answer

Set the default encryption on each bucket to disable encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.

Answer

Create an IAM policy with a global condition for SSE and attach it to all users and roles.

Question 5

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Accepted Answer

Attach the VPCs in member accounts to the transit gateway.. Attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.

Answer

Create VPC endpoints for the transit gateway in each VPC.

Answer

Create VPC peering connections between each VPC and the networking VPC.

Question 6

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.. AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer. Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).

Answer

Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.

Answer

Configure AWS IAM Identity Center to restrict access to approved Regions.

Answer

Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.

Question 7

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Deploy an AWS Transit Gateway and attach all VPCs (business unit and shared services) to it.. AWS Transit Gateway acts as a hub-and-spoke router, allowing all VPCs (business units and shared services) to connect through a single gateway. This minimizes latency by using the AWS global network backbone and maximizes throughput with up to 50 Gbps per VPC attachment, scaling horizontally across multiple attachments. It simplifies management compared to mesh peering and avoids the bandwidth limitations of VPN or PrivateLink for inter-VPC routing.

Answer

Create a VPN connection from each business unit VPC to the shared services VPC.

Answer

Use AWS PrivateLink to connect services in the shared services VPC to the business unit VPCs.

Answer

Set up VPC peering between each business unit VPC and the shared services VPC.

Question 8

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny creation of IAM roles except through AWS CloudFormation, and use a centrally managed CloudFormation template via StackSets.. AWS Organizations SCPs can be used to deny the creation of IAM roles except through AWS CloudFormation, ensuring that roles are only created via a centrally managed template. By combining this with AWS CloudFormation StackSets, the security team can deploy IAM roles from a single template across all member accounts, enforcing the principle of least privilege and providing full auditability through CloudFormation stack events and AWS CloudTrail.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles from a central template in each account.

Answer

Configure AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them.

Answer

Create a Lambda function that monitors CloudTrail events for role creation and sends alerts.

Question 9

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

Accepted Answer

AWS Cost Explorer with cost allocation tags.. Cost allocation tags in AWS allow you to tag resources (e.g., EC2 instances, S3 buckets) with department IDs and then use AWS Cost Explorer to view cost breakdowns by those tags. This directly meets the requirement to track costs per department account within AWS Organizations with consolidated billing.

Answer

AWS Budgets with tag-based filters.

Answer

AWS Trusted Advisor cost optimization checks.

Answer

AWS Cost Explorer with tag-based filtering.

Question 10

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.. AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Answer

Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.

Answer

Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.

Answer

Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.

Question 11

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

Accepted Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.. AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Answer

Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.

Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.

Answer

Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.

Question 12

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

Accepted Answer

Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.. Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Answer

Create a separate AWS account for prod and use an IAM policy on the account.

Answer

Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.

Answer

Use AWS Config to detect non-approved instance types and terminate them.

Question 13

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

Accepted Answer

Create an AWS Service Catalog product that uses AWS Organizations APIs to create a new account, applies a baseline CloudFormation template, and moves the account to the correct OU.. It uses AWS Service Catalog to provide a self-service portal for the development team, while the central IT team retains governance by embedding AWS Organizations API calls to create accounts, apply a baseline CloudFormation template for security and compliance, and automatically move the account to the correct Organizational Unit (OU). This approach enforces guardrails without granting direct management account access.

Answer

Use AWS CloudFormation StackSets to create accounts in bulk.

Answer

Use the AWS Organizations console to manually create accounts and assign them to the appropriate OU.

Answer

Give the development team the credentials to the management account and let them create accounts directly.

Question 14

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Accepted Answer

AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.. AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Answer

Service control policies (SCPs) apply to all accounts in the organization, including the management account.

Answer

Each account in an organization must have its own payment method.

Answer

AWS Config rules cannot be applied across accounts via AWS Organizations.

Question 15

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Answer

AWS Key Management Service (KMS)

Answer

AWS Config

Answer

AWS CloudTrail