SAP-C02 Design Solutions for Organizational Complexity Practice Test 27 — 15 Questions

Question 1

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use separate AWS accounts for each environment to provide strong isolation.. Option C is correct because using separate AWS accounts for each environment (development, testing, production) provides the strongest isolation boundary in AWS Organizations, since accounts are the primary security and billing boundary and prevent changes in one environment from affecting another. Option E is correct because Service Control Policies (SCPs) applied at the OU level let the company enforce distinct permission guardrails per OU, ensuring that actions allowed in development or testing OUs cannot be applied to production accounts. Options A and B are incorrect because sharing cross-account role assumptions broadly or sharing a single VPC across all OUs weakens isolation and increases the blast radius of misconfigurations. Option D is incorrect because resource tagging is only a labeling and governance mechanism, not a security boundary, so it cannot provide the strong isolation that separate accounts and SCPs deliver.

Answer

Allow all users to assume cross-account roles for easier management.

Answer

Share the same VPC across all OUs to simplify networking.

Answer

Use resource tagging to isolate environments instead of accounts.

Question 2

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

Accepted Answer

Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single central S3 bucket in a logging account by setting up a CloudTrail trail in each account that points to the same bucket. This approach requires minimal administrative overhead as it leverages native AWS cross-account logging capabilities without additional data movement or transformation services.

Answer

Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.

Answer

Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.

Question 3

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

Accepted Answer

Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.. AWS Transit Gateway allows you to centralize network connectivity across multiple VPCs and accounts. By creating the Transit Gateway in the networking account and sharing it via AWS Resource Access Manager (RAM), you enable individual account owners to attach their VPCs to the shared Transit Gateway, achieving private communication while maintaining centralized management.

Answer

Create a VPN connection from each VPC to a central network appliance.

Answer

Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

Answer

Create VPC peering connections between each VPC and a central VPC.

Question 4

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

Accepted Answer

Use the IAM Identity Center console to add the member account as a delegated administrator.. AWS IAM Identity Center allows you to designate a member account as a delegated administrator directly from the IAM Identity Center console in the management account. This grants the member account the necessary permissions to manage users, groups, and permission sets without requiring cross-account roles or resource sharing.

Answer

Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.

Answer

Use a service control policy to allow the member account to manage IAM Identity Center.

Answer

Create an IAM role in the management account and allow the member account to assume it.

Question 5

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

Accepted Answer

Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.. AWS Resource Access Manager (RAM) allows you to share AWS Managed Microsoft AD directories across accounts without duplicating the directory or managing multiple trust relationships. This provides a single, centrally managed directory that multiple VPCs in different accounts can authenticate against, ensuring scalability and security by avoiding cross-account credential replication or complex VPN meshes.

Answer

Set up a VPN connection from each VPC to the on-premises AD.

Answer

Clone the directory and deploy it in each account.

Answer

Deploy an AD Connector in each VPC pointing to the on-premises AD.

Question 6

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

Accepted Answer

Use cost allocation tags to tag resources with a department tag.. Cost allocation tags allow you to tag AWS resources with metadata (e.g., department name) and then activate those tags in the AWS Billing and Cost Management console. Once activated, AWS generates cost reports that break down spending by those tags, enabling the finance team to map costs to each department's account. This is the native, recommended approach for cost attribution across accounts in AWS Organizations.

Answer

Use Amazon CloudWatch custom metrics to record department IDs.

Answer

Use service control policies (SCPs) to restrict costs per account.

Answer

Use AWS Budgets to create budgets per department.

Question 7

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an organization trail in the management account with CloudTrail.. AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.

Answer

Enable CloudWatch Logs in each account and stream to a central log group.

Answer

Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Enable S3 server access logs on all accounts and send to a central bucket.

Question 8

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

Accepted Answer

Create an IAM role in each target account with a trust policy allowing the management account to assume it.. AWS CloudFormation StackSets require the management account to assume an IAM role in each target account to deploy resources. This role must have a trust policy that allows the management account's StackSets service-linked role (or a custom role) to assume it, granting the necessary permissions to create, update, or delete stack instances across accounts. Without this cross-account trust relationship, StackSets cannot perform operations in target accounts.

Answer

Create IAM users in target accounts with AdministratorAccess.

Answer

Use a CloudFormation service role in the management account.

Answer

Apply an SCP to allow CloudFormation actions across accounts.

Question 9

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

Accepted Answer

An AWS Organizations management account.. AWS Control Tower requires an AWS Organizations management account because Control Tower uses Organizations to create and manage accounts, apply service control policies (SCPs), and enforce guardrails across the organization. The management account serves as the central point for all administrative actions, and without it, Control Tower cannot establish the necessary multi-account structure or landing zone.

Answer

A pre-configured landing zone.

Answer

At least three organizational units (OUs).

Answer

Existing AWS Config rules in all accounts.

Question 10

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

Accepted Answer

Users can be granted access to multiple accounts from a central location.. Option A is correct because IAM Identity Center is designed for centralized multi-account access: from the management account you create permission sets and assign users/groups to multiple AWS accounts, and users then access those accounts through the AWS access portal without per-account IAM users. Option E is correct because Identity Center includes a built-in Identity Center directory where you can create and manage users and groups directly, in addition to connecting external identity sources such as Active Directory or SAML/OIDC providers. Option B is incorrect because Identity Center federates users into accounts via IAM roles, so users do not need to exist as IAM users in each account. Option C is incorrect because an on-premises Active Directory is optional, not required; the Identity Center directory or another external IdP can be used. Option D is incorrect because permission sets are not assigned to IAM roles in the management account; they are AWS-managed entities assigned to users/groups for target accounts, where Identity Center provisions corresponding IAM roles in those accounts.

Answer

Users must be IAM users in each account.

Answer

Identity Center requires an on-premises Active Directory.

Answer

Permission sets are assigned to IAM roles in the management account.

Question 11

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to deploy the AWS Config rule across all accounts in the organization.. AWS CloudFormation StackSets with automatic deployment can deploy the AWS Config rule across all accounts in an AWS Organization, including newly created member accounts, by targeting the root organizational unit (OU). This ensures that the Config rule is automatically enabled in new accounts as they are created, meeting the security team's requirement without manual intervention.

Answer

Use an SCP in the root to require encryption on S3 buckets.

Answer

Create an AWS Config rule in the management account and delegate an admin account to apply it to all member accounts.

Answer

Configure AWS CloudTrail to automatically enable the AWS Config rule in new accounts.

Question 12

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 13

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.. Option D is correct because CloudTrail management events capture IAM API calls such as CreateRole, UpdateRole, and PutRolePolicy, and integrating CloudTrail with CloudWatch Logs in every account (or via an organization trail) delivers those events to a central place for monitoring. Option B is correct because a CloudWatch Logs metric filter matches patterns for IAM role creation/modification events in the delivered CloudTrail logs, and an associated CloudWatch alarm triggers the required alerting. Together, D provides the logging pipeline and B provides detection and alerting. Option A is not appropriate because AWS Config records resource configuration changes and compliance, not the API call events needed for real-time alerting on IAM role creation/modification. Option C is wrong because an SCP that denies IAM role creation/modification would block the activity rather than log and alert on it. Option E is wrong because IAM Access Analyzer identifies resource access and permissions issues, not API call logging or alerting.

Answer

Use AWS Config to record IAM role changes and stream to CloudWatch Logs.

Answer

Create an SCP that denies IAM role creation and modification.

Answer

Enable IAM Access Analyzer to monitor IAM role usage.

Question 14

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

Accepted Answer

Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.. A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.

Answer

Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

Answer

Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

Answer

Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

Question 15

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

Accepted Answer

Restrict access to the management account and use it only for organization management tasks.. The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.

Answer

Enable all AWS services in the management account to centrally manage them.

Answer

Use the management account as the payer account and also host production workloads.

Answer

Use the management account for development environments to avoid creating additional accounts.