SAP-C02 Design Solutions for Organizational Complexity Practice Test 28 — 15 Questions

Question 1

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

Accepted Answer

The transit gateway route tables are not associated with the application VPC attachments.. The most likely cause is that the transit gateway route tables are not associated with the application VPC attachments. Even if the VPN routes are propagated into the transit gateway route tables, the application VPCs will not receive those routes unless their VPC attachments are explicitly associated with the correct transit gateway route table. Without this association, the transit gateway does not propagate routes to the attached VPCs, leaving them unable to reach the on-premises network.

Answer

The application VPCs have route tables that override the transit gateway routes with local routes.

Answer

The VPN connection is not configured to advertise the on-premises CIDR to the transit gateway.

Answer

The application VPCs have security groups that block traffic to the on-premises network.

Question 2

A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.. Option A is correct because it combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.

Answer

Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.

Answer

Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.

Answer

Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.

Question 3

A company has a centralized logging account and multiple member accounts. The security team wants to enable VPC Flow Logs for all VPCs across all accounts and centralize the logs in the logging account. The solution must be automated and ensure that new VPCs are automatically included. Which approach should be taken?

Accepted Answer

Use an AWS Config rule to detect VPCs without Flow Logs and trigger an AWS Systems Manager Automation runbook to enable them, publishing to a centralized Amazon S3 bucket.. Option C is correct because AWS Config can continuously evaluate all VPCs against a custom rule that checks for the presence of VPC Flow Logs. When a non-compliant VPC is detected (including newly created ones), Config can trigger an AWS Systems Manager Automation runbook that enables Flow Logs and publishes them to a centralized Amazon S3 bucket in the logging account. This approach is fully automated, covers existing and new VPCs, and centralizes logs without requiring event-driven triggers that might miss resources created before the rule was deployed.

Answer

Use AWS CloudTrail to monitor VPC creation and invoke an AWS Lambda function to enable Flow Logs.

Answer

Use Amazon EventBridge to capture VPC creation events and trigger an AWS Lambda function to enable Flow Logs.

Answer

Use AWS Trusted Advisor to check VPC Flow Logs configuration and send alerts to an Amazon SNS topic.

Question 4

A large enterprise is migrating to AWS and wants to implement a multi-account strategy with centralized network connectivity. The company has multiple VPCs in various accounts that need to communicate with each other and with on-premises resources. The solution must be scalable and minimize operational overhead. Which design should be used?

Accepted Answer

Use an AWS Transit Gateway in a central network account and attach all VPCs from the various accounts.. Option D is correct because AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks, enabling scalable, low-operational-overhead connectivity across multiple accounts. By placing the Transit Gateway in a central network account and using AWS Resource Access Manager to share it with other accounts, the enterprise can avoid the complexity of managing many individual connections while supporting transitive routing and centralized control.

Answer

Use AWS PrivateLink to connect VPCs via interface endpoints.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Set up a VPN connection from each VPC to the on-premises network and use routing to enable inter-VPC communication.

Question 5

A company is using AWS Organizations with multiple accounts. The central IT team wants to enforce that all EC2 instances are launched with specific tags (e.g., CostCenter and Environment). The solution should prevent any untagged instances from being created. Which approach should be taken?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.. Option D is correct because an SCP can deny the ec2:RunInstances action if the required tags are not present. Option A is wrong because AWS Config rules can detect non-compliance but cannot prevent the action. Option B is wrong because IAM policies in each account would require manual management. Option C is wrong because tagging is not enforced at launch.

Answer

Use AWS Service Catalog to provision EC2 instances only from pre-configured products that include required tags.

Answer

Use an AWS Config rule to detect untagged instances and trigger a Lambda function to terminate them.

Answer

Create an IAM policy for each account that requires tags on instance creation.

Question 6

A company wants to centralize management of IAM users and groups across multiple AWS accounts. The solution should allow users to access resources in any account without needing separate credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and applications. It integrates with AWS Organizations to manage user and group permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Question 7

A company is using a multi-account strategy with AWS Organizations. The security team discovers that an SCP intended to block access to non-compliant AWS regions is not working. The SCP is attached to the root OU. When a user in a member account attempts to launch an EC2 instance in a blocked region, the request succeeds. What is the most likely cause?

Accepted Answer

The user belongs to the management account, and SCPs do not apply to the management account.. SCPs do not apply to the management account of an AWS Organizations hierarchy. Since the user belongs to the management account, the SCP attached to the root OU has no effect on their actions, allowing the EC2 launch in a blocked region to succeed.

Answer

The IAM policy of the user overrides the SCP.

Answer

The SCP is not attached to the member account's OU.

Answer

The SCP is missing an explicit allow statement for the regions.

Question 8

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?

Accepted Answer

AWS IAM Identity Center (AWS SSO) with an AWS Managed Microsoft AD directory. AWS IAM Identity Center (formerly AWS SSO) can be integrated with an AWS Managed Microsoft AD directory to provide a single sign-on experience across multiple AWS accounts and business applications. This integration allows users to authenticate using their existing on-premises Active Directory credentials via AD Connector or a two-way forest trust, enabling seamless access to the AWS Management Console, command-line interface, and supported SAML 2.0 applications.

Answer

Amazon Cognito user pools

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Question 9

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

Accepted Answer

Use AWS Organizations to create a central management account and use AWS Systems Manager Explorer to aggregate operational data.. Option D is correct because AWS Systems Manager Explorer, when used with AWS Organizations, provides a single-pane-of-glass dashboard that aggregates operational data (e.g., cost reports, security findings, resource inventory) across multiple accounts. The central management account in Organizations enables Explorer to collect and display data from all member accounts without requiring individual connections or manual aggregation.

Answer

Use Amazon QuickSight to connect to each account's AWS Cost and Usage Report and AWS Config data.

Answer

Use AWS Control Tower to set up a landing zone and use the built-in dashboard for operational data.

Answer

Use AWS Config aggregator to collect resource configurations from all accounts.

Question 10

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only T3 and M5 instances. Which SCP should be applied?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}. Option A is correct because it uses a Deny effect with a StringNotEquals condition on ec2:InstanceType to block any instance type that does not match the patterns 't3.*' or 'm5.*'. This effectively restricts all accounts in the organization to only T3 and M5 instance families when launching EC2 instances, as any attempt to use a non-allowed type will be denied. The wildcard (*) in the Resource element covers all resources, ensuring the policy applies broadly.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}

Question 11

A company is planning to migrate its on-premises workload to AWS. The workload consists of a stateful web application that requires a static IP address for whitelisting by third-party services. The company will use a multi-AZ deployment. Which TWO services should be used together to meet these requirements?

Accepted Answer

Network Load Balancer (NLB). A Network Load Balancer (NLB) provides a static IP address per Availability Zone, which can be whitelisted by third-party services. It operates at Layer 4 and can handle stateful web application traffic without modifying the source IP, preserving client IP visibility for the application. Combined with a multi-AZ deployment, the NLB ensures high availability and a fixed IP endpoint for external whitelisting.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to enforce encryption at rest for all Amazon S3 buckets across the organization. The solution must be automated and should not prevent existing compliant buckets from being used. Which TWO services should be combined to achieve this?

Accepted Answer

AWS Config. Options A and C are correct because AWS Config can detect non-compliant buckets, and AWS CloudFormation StackSets can deploy a bucket policy to enforce encryption. Option B is wrong because SCPs cannot enforce encryption settings on existing buckets. Option D is wrong because AWS Trusted Advisor only provides recommendations, not enforcement. Option E is wrong because AWS Lambda alone cannot deploy policies across accounts without additional orchestration.

Answer

AWS Lambda

Answer

AWS Trusted Advisor

Answer

Service control policy (SCP)

Question 13

A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create a customer-managed KMS key with a key policy that allows the consumer accounts to use the key.. Option A is correct because creating a customer-managed KMS key (CMK) with a key policy that explicitly grants the consumer accounts permission to use the key (e.g., via the `kms:Decrypt` and `kms:GenerateDataKey` actions) is required for cross-account encryption. This ensures that the S3 bucket can encrypt objects with the CMK, and consumer accounts can decrypt them using their own IAM permissions, meeting the security team's requirement for strict key control.

Answer

Use an SCP to require that all S3 buckets use server-side encryption with KMS.

Answer

Create IAM roles in each consumer account that grant access to the KMS key.

Question 14

A large e-commerce company uses a multi-account AWS Organizations setup with a central logging account. The company has enabled AWS CloudTrail in all accounts and configured it to deliver logs to a centralized Amazon S3 bucket in the logging account. Recently, the security team noticed that some log files are missing for a period of 2 hours. The CloudTrail console shows that trails are still enabled and delivering to the bucket, but no new log files were created during that time. The team verified that there were API calls made during that period. Which action is most likely to resolve the issue and prevent recurrence?

Accepted Answer

Check the S3 bucket policy in the logging account to ensure it grants the required permissions to the CloudTrail service principal from all accounts.. The most likely cause is that the S3 bucket policy in the central logging account does not grant the necessary permissions for CloudTrail from all accounts to write log files. Even though trails are enabled and appear to be delivering, a missing or misconfigured bucket policy can silently drop log deliveries when the CloudTrail service principal (cloudtrail.amazonaws.com) attempts to write objects. The security team verified API calls occurred, so the issue is at the delivery destination, not the trail configuration itself.

Answer

Review the SCPs attached to the organization root; there might be a policy that denies CloudTrail actions.

Answer

Ensure that the KMS key used for encryption is accessible by the CloudTrail service.

Answer

Enable AWS Config to monitor CloudTrail delivery status and automatically restart the trail if logs are missing.

Question 15

A company is migrating a legacy application to AWS. The application requires a static IP address that can be used for whitelisting by third-party partners. The application will be deployed in multiple Availability Zones for high availability. The company wants to use a load balancer to distribute traffic. The solution must provide a single static IP address that does not change even if the underlying instances are replaced. Which combination of services should the company use?

Accepted Answer

Use a Network Load Balancer (NLB) with Elastic IP addresses assigned to each subnet.. Option D is correct because a Network Load Balancer (NLB) supports static IP addresses by allowing you to assign Elastic IP addresses to each Availability Zone subnet. This provides a single static IP per AZ that does not change even when backend instances are replaced, meeting the requirement for a fixed whitelisting address across multiple AZs.

Answer

Use an Application Load Balancer (ALB) with a static Elastic IP address attached to the ALB.

Answer

Use AWS Global Accelerator with an ALB as the endpoint.

Answer

Use Amazon CloudFront with an ALB as the origin.