SAP-C02 Design Solutions for Organizational Complexity Practice Test 28 — 15 Questions

Question 1

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.. AWS Resource Access Manager (RAM) allows you to share a subnet from a central VPC in the networking account with other AWS accounts without creating separate VPCs or complex networking. This enables workload accounts to launch resources directly into the shared subnet, achieving low latency by keeping them in the same VPC and Availability Zone. RAM handles the cross-account sharing with minimal operational overhead, as it does not require additional network appliances or routing configuration.

Answer

Create a separate VPC in each account and connect them with VPC peering.

Answer

Set up an AWS Transit Gateway and attach the VPCs from each account.

Answer

Create VPC peering connections between the networking account and each workload account.

Question 2

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

Accepted Answer

The SCP does not include an explicit allow for the sts:GetSessionToken action.. When users authenticate with MFA, the AWS Management Console calls the STS GetSessionToken API to obtain temporary credentials that include the MFA session. If the SCP denies all actions, including sts:GetSessionToken, then even with valid MFA the user cannot obtain the necessary temporary credentials, resulting in access denial. The SCP must explicitly allow the sts:GetSessionToken action for users who authenticate with MFA. Option B is incorrect because the issue is not about the users' IAM policies but about the SCP. Option C is incorrect because SCPs apply to all principals in the account, including administrators. Option D is incorrect because the SCP does not inherently affect the root user differently; root user is not affected by SCPs in the management account.

Answer

The IAM policy attached to the users does not allow any actions.

Answer

The SCP does not apply to users who have administrative privileges.

Answer

The SCP also denies access to the root user of each account.

Question 3

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

Accepted Answer

Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.. AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Answer

Use an AWS Config aggregator to deploy rules across accounts.

Answer

Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

Answer

Use AWS Config to create a custom rule in each account manually.

Question 4

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Accepted Answer

Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.. Option C is correct because the template itself must define the AWS::S3::Bucket resource with encryption enabled (for example, BucketEncryption with SSE-S3 or SSE-KMS) so that every deployed bucket has default encryption. Option D is correct because CloudFormation StackSets are the AWS Organizations-integrated mechanism for deploying a single template across many accounts from the management account. Option E is correct because a StackSet requires you to specify the target accounts (or organizational units) and regions, and to supply an IAM execution role that CloudFormation assumes in each target account to create the resources. Option A is not required as a separate step because StackSets use a single execution role (often created automatically or supplied via the StackSet configuration) rather than manually creating a role in each member account. Option B is not required because an SCP is a permissions guardrail, not a deployment mechanism; CloudFormation StackSets handle the cross-account deployment, and no SCP specifically allowing S3 bucket creation is needed.

Answer

Create an IAM role in each member account that allows CloudFormation to create resources.

Answer

Create an SCP that allows CloudFormation to create S3 buckets.

Question 5

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

Accepted Answer

Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met. A service control policy (SCP) attached to the root of the AWS Organizations hierarchy can deny S3 PutObject or CreateBucket actions unless the request includes the specific KMS key ID (via the s3:x-amz-server-side-encryption-aws-kms-key-id condition key). This enforces encryption centrally across all accounts, as SCPs are inherited by all member accounts and cannot be overridden by IAM policies within those accounts.

Answer

Create IAM policies in each account to enforce encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Deploy a CloudFormation StackSet that creates S3 buckets with encryption

Question 6

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization. By defining the VPC flow log resource with the central S3 bucket ARN and the KMS key from the security account (using a cross-account KMS key policy), StackSets can automatically create flow logs in all member accounts with the required encryption, making it the most efficient and centralized approach.

Answer

Manually create VPC flow logs in each account and point to the central S3 bucket

Answer

Use AWS Config rules to enforce flow log creation across accounts

Answer

Use AWS Systems Manager Automation to create flow logs in each account

Question 7

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Accepted Answer

Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it. It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.

Answer

Use a service control policy to allow access from other accounts

Answer

Create IAM users in the development account for each developer

Answer

Share the access keys of an IAM user in the development account

Question 8

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

Accepted Answer

The trail is not an organization trail. The exhibit shows that the CloudTrail trail 'my-trail' is not configured as an organization trail. In AWS Organizations, a trail must be explicitly created as an organization trail to automatically log management events from all member accounts. Without this setting, the trail only captures events from the management account, not the entire organization.

Answer

The trail is not a multi-region trail

Answer

The trail does not include global service events

Answer

The trail has log file validation enabled, which prevents cross-account delivery

Question 9

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

Accepted Answer

Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.. Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum permissions for all accounts in an organizational unit (OU). By attaching an SCP that denies EC2 actions in non-compliant regions, you enforce the restriction across multiple accounts without needing to manage individual IAM policies or roles, making it the most scalable solution.

Answer

Create an IAM role in each account with a policy to deny non-compliant regions.

Answer

Use AWS Config rules to detect and terminate instances in non-compliant regions.

Answer

Create an IAM policy in each account to deny non-compliant regions.

Question 10

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

Accepted Answer

Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.. Applying an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key enforces the encryption requirement across all accounts in the organization. Additionally, using AWS Config rules detects and remediates existing non-compliant buckets, ensuring ongoing compliance. This combination provides preventive and detective controls.

Answer

Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.

Answer

Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.

Question 11

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

AWS CloudFormation Change Sets. AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the DevOps team to review and approve stack updates by generating a summary of the changes (additions, modifications, deletions) without executing them immediately, meeting the requirement for a review-and-approval workflow.

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Nested Stacks

Question 12

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

Accepted Answer

Use Amazon ECS with Fargate launch type, defining services across multiple AZs.. Amazon ECS with Fargate is the best choice because it provides serverless container orchestration, automatically managing infrastructure and scaling. By deploying services across multiple Availability Zones, it ensures high availability and low-latency communication without the operational overhead of managing EC2 instances or Kubernetes control planes. AWS Lambda introduces cold start latency and a 15-minute execution limit, making it unsuitable for strict latency requirements and long-running microservices. EC2 instances and EKS require more operational overhead for patching and scaling. Fargate minimizes that overhead while meeting latency and multi-AZ requirements.

Answer

Use AWS Lambda functions for each microservice, triggered by API Gateway.

Answer

Deploy each microservice on Amazon EC2 instances in an Auto Scaling group across AZs.

Answer

Use Amazon EKS with worker nodes on EC2, and deploy microservices as Kubernetes pods.

Question 13

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

Accepted Answer

Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.. AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs attach to a central Transit Gateway, and a dedicated inspection VPC (with the security appliance) acts as the central inspection point. By configuring route tables in the Transit Gateway to route all inter-VPC traffic through the inspection VPC, you achieve mandatory traffic inspection without complex peering or performance bottlenecks.

Answer

Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.

Answer

Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.

Answer

Create VPC peering connections between all VPCs and route traffic through a security VPC.

Question 14

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 15

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

Accepted Answer

Define cost allocation tags for each department and enable them in the Billing and Cost Management console.. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Finance') and then activate those tags in the Billing and Cost Management console. Once enabled, AWS Cost Explorer and cost reports can filter and group costs by these tags, providing accurate per-department cost tracking across multiple accounts in AWS Organizations. This is the most precise method because it directly associates resource usage with the department responsible, regardless of which account hosts the resource.

Answer

Use AWS Cost Explorer to view costs by linked account.

Answer

Set up AWS Budgets for each department with alerts.

Answer

Create AWS Resource Groups for each department and use AWS Config to track costs.