SAP-C02 Design Solutions for Organizational Complexity Practice Test 27 — 15 Questions

Question 1

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.. AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer. Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).

Answer

Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.

Answer

Configure AWS IAM Identity Center to restrict access to approved Regions.

Answer

Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.

Question 2

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with a specific KMS key. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the specified KMS key is used.. Using an SCP under the root OU prevents any account from creating unencrypted buckets or using a different KMS key. Option A is wrong because individual account IAM policies are harder to manage at scale. Option C is wrong because AWS Config can detect but not enforce. Option D is wrong because CloudFormation StackSets require manual deployment to each account.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to encrypt them retroactively.

Answer

Deploy a CloudFormation StackSet that creates a bucket policy in each account requiring encryption.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless the specified KMS key is used.

Question 3

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

Accepted Answer

Deploy an AWS Transit Gateway and attach all VPCs (business unit and shared services) to it.. AWS Transit Gateway acts as a hub-and-spoke router, allowing all VPCs (business units and shared services) to connect through a single gateway. This minimizes latency by using the AWS global network backbone and maximizes throughput with up to 50 Gbps per VPC attachment, scaling horizontally across multiple attachments. It simplifies management compared to mesh peering and avoids the bandwidth limitations of VPN or PrivateLink for inter-VPC routing.

Answer

Create a VPN connection from each business unit VPC to the shared services VPC.

Answer

Use AWS PrivateLink to connect services in the shared services VPC to the business unit VPCs.

Answer

Set up VPC peering between each business unit VPC and the shared services VPC.

Question 4

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny creation of IAM roles except through AWS CloudFormation, and use a centrally managed CloudFormation template via StackSets.. Option B is correct because AWS Organizations SCPs can be used to deny the creation of IAM roles except through AWS CloudFormation, ensuring that roles are only created via a centrally managed template. By combining this with AWS CloudFormation StackSets, the security team can deploy IAM roles from a single template across all member accounts, enforcing the principle of least privilege and providing full auditability through CloudFormation stack events and AWS CloudTrail.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles from a central template in each account.

Answer

Configure AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them.

Answer

Create a Lambda function that monitors CloudTrail events for role creation and sends alerts.

Question 5

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

Accepted Answer

AWS Cost Explorer with cost allocation tags.. Cost allocation tags in AWS allow you to tag resources (e.g., EC2 instances, S3 buckets) with department IDs and then use AWS Cost Explorer to view cost breakdowns by those tags. This directly meets the requirement to track costs per department account within AWS Organizations with consolidated billing.

Answer

AWS Budgets with tag-based filters.

Answer

AWS Trusted Advisor cost optimization checks.

Answer

AWS Cost Explorer with tag-based filtering.

Question 6

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.. Option B is correct because AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Answer

Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.

Answer

Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.

Answer

Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.

Question 7

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

Accepted Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.. Option D is correct because AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Answer

Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.

Answer

Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.

Answer

Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.

Question 8

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

Accepted Answer

Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.. Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Answer

Create a separate AWS account for prod and use an IAM policy on the account.

Answer

Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.

Answer

Use AWS Config to detect non-approved instance types and terminate them.

Question 9

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

Accepted Answer

Create an AWS Service Catalog product that uses AWS Organizations APIs to create a new account, applies a baseline CloudFormation template, and moves the account to the correct OU.. Option A is correct because it uses AWS Service Catalog to provide a self-service portal for the development team, while the central IT team retains governance by embedding AWS Organizations API calls to create accounts, apply a baseline CloudFormation template for security and compliance, and automatically move the account to the correct Organizational Unit (OU). This approach enforces guardrails without granting direct management account access.

Answer

Use AWS CloudFormation StackSets to create accounts in bulk.

Answer

Use the AWS Organizations console to manually create accounts and assign them to the appropriate OU.

Answer

Give the development team the credentials to the management account and let them create accounts directly.

Question 10

A company uses AWS Organizations with hundreds of accounts. They want to centrally manage VPC security group rules to ensure that only approved CIDR ranges are allowed for SSH access. Which solution is MOST scalable and auditable?

Accepted Answer

Use AWS CloudFormation StackSets to deploy security groups with approved rules, and use an SCP to deny creation or modification of security groups outside of CloudFormation.. Option D is correct because it combines CloudFormation StackSets for deploying approved security groups across hundreds of accounts with an SCP that denies ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress actions unless they originate from CloudFormation (using the aws:ViaAWSService condition key). This ensures that only centrally managed, auditable deployments can create or modify security groups, providing both scalability and a clear audit trail via CloudFormation change sets and StackSet operations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remove the offending rules.

Answer

Create an SCP that denies ec2:AuthorizeSecurityGroupIngress for SSH ports unless the CIDR is in an approved list.

Answer

Use AWS Firewall Manager to centrally manage security group rules across accounts.

Question 11

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Accepted Answer

AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.. Option B is correct because AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Answer

Service control policies (SCPs) apply to all accounts in the organization, including the management account.

Answer

Each account in an organization must have its own payment method.

Answer

AWS Config rules cannot be applied across accounts via AWS Organizations.

Question 12

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Answer

AWS Key Management Service (KMS)

Answer

AWS Config

Answer

AWS CloudTrail

Question 13

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

Accepted Answer

Use AWS Organizations to define a tag policy that mandates the cost center tag.. Option A is correct because AWS Organizations tag policies allow you to define rules for tagging resources across accounts in your organization. By specifying the cost center tag as mandatory in a tag policy, you can enforce that all resources must have this tag, and any non-compliant resources can be reported or prevented from being created, depending on the policy's enforcement mode.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.

Answer

Enable AWS Cost Explorer to report on untagged resources.

Question 14

Refer to the exhibit. A security engineer applied this bucket policy to an S3 bucket. A developer tries to upload an object using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload fails because the policy denies PutObject when encryption is not KMS with the specific key.. The bucket policy includes a Deny statement that explicitly denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms and the x-amz-server-side-encryption-aws-kms-key-id header matching the specific KMS key ARN. Since the developer does not specify any encryption, the condition fails, and the Deny statement applies, causing the upload to fail.

Answer

The upload succeeds because the policy only denies if encryption is not KMS.

Answer

The upload fails because the bucket policy is malformed and rejects all requests.

Answer

The upload succeeds because the developer is using the AWS CLI with default encryption settings.

Question 15

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

Accepted Answer

Verify that the AWS Config aggregator in the security account has the correct authorization to assume a role in each member account.. Option D is correct because AWS Config aggregators require cross-account authorization to collect configuration data from member accounts. Even if AWS Config is enabled in member accounts, the aggregator in the security account must have the correct IAM role permissions (via an IAM role in each member account) to assume and retrieve configuration snapshots. Without this authorization, the aggregator cannot access the member accounts' data, causing them to not appear.

Answer

Ensure that the member accounts have enabled AWS Config in the same region as the aggregator.

Answer

Check if the member accounts have exceeded the AWS Config resource limits.

Answer

Check if the AWS Config recorder in the member accounts is configured to record all resource types.