SAP-C02 Design Solutions for Organizational Complexity Practice Test 29 — 15 Questions

Question 1

A company has multiple AWS accounts and wants to centralize the management of security policies. The security team needs to enforce that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. The solution must be centrally managed and automatically applied to new accounts as they are added. Which approach should be taken?

Accepted Answer

Create an SCP that denies console access for IAM users if MFA is not present.. AWS Organizations Service Control Policies (SCPs) can centrally deny AWS API actions (including console access) for all IAM users across multiple accounts if the `aws:MultiFactorAuthPresent` condition key is false. This approach is centrally managed from the management account and automatically applies to new accounts added to the organization, meeting the requirement for centralized enforcement and scalability.

Answer

Use AWS Config to detect IAM users without MFA and send alerts.

Answer

Use AWS IAM Identity Center to enforce MFA for all users accessing the console.

Answer

Create an IAM policy in each account that denies console access without MFA.

Question 2

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

Accepted Answer

Use a Service Control Policy (SCP) in AWS Organizations that denies s3:CreateBucket if the request does not include the required tags.. Option C is correct because a Service Control Policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action if the request does not include the required tags (cost center and environment). SCPs apply to all accounts in the organization, enforcing the tagging requirement at the API level before the bucket is created, which is the most effective preventive control.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template with tags.

Answer

Use IAM policies in each account to require tags on bucket creation.

Answer

Use AWS Config rules to automatically tag buckets after creation.

Question 3

A global company with 50 AWS accounts uses AWS Organizations and wants to centralize CloudTrail logs. The security team requires that all accounts send their CloudTrail logs to a central S3 bucket in the audit account. Which combination of steps will ensure this?

Accepted Answer

Create a CloudTrail trail in the audit account with an S3 bucket, and add a bucket policy that grants cross-account permissions for each member account to deliver logs. Then configure each member account to use the same trail.. Option D is correct because it uses a single CloudTrail trail in the audit account with a central S3 bucket, and the bucket policy grants the necessary s3:PutObject permissions to each member account's CloudTrail service principal. Each member account then configures CloudTrail to use the same trail (the audit account's trail), which allows CloudTrail to deliver logs from all accounts to the central bucket without requiring separate trails or manual log forwarding.

Answer

Use AWS Config to forward logs to a central S3 bucket.

Answer

Enable CloudTrail in each account and use AWS Organizations to aggregate logs.

Answer

Create a CloudTrail trail in the audit account that logs all accounts via CloudWatch Logs.

Question 4

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

Accepted Answer

Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.. Option C is correct because a Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Answer

Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

Answer

Use AWS CloudFormation templates that specify t3.micro.

Answer

Use AWS Config rules to terminate non-compliant instances.

Question 5

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

Accepted Answer

Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.. Option C is correct because AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.

Answer

Use AWS Config to detect and delete untagged VPCs.

Answer

Use IAM policies in each account to require tags.

Answer

Use AWS CloudFormation StackSets to deploy VPC templates with tags.

Question 6

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

Accepted Answer

Apply an SCP that denies all actions if the principal does not have MFA.. Option D is correct because Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor and disable users without MFA.

Answer

Set an IAM password policy that requires MFA for all users.

Question 7

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that integrates with AWS Organizations to centrally manage backups across multiple accounts. It allows you to define backup policies that automatically apply to EC2 instances and other supported resources across all member accounts, ensuring compliance and centralized monitoring without requiring per-account manual configuration.

Answer

AWS CloudEndure Disaster Recovery

Answer

Amazon S3 Glacier

Answer

AWS Storage Gateway

Question 8

A company uses AWS Organizations with a central logging account. They want to ensure that all VPC Flow Logs from member accounts are published to a central S3 bucket in the logging account. Which steps are required?

Accepted Answer

Configure VPC Flow Logs in each member account to deliver to a central S3 bucket using a bucket policy.. Option A is correct because VPC Flow Logs can be published directly to an S3 bucket in a different account by configuring the destination S3 bucket with a bucket policy that grants the required permissions (e.g., `AWS:SourceAccount` and `AWS:SourceArn`) to the member account's VPC Flow Logs service. This allows each member account to write flow logs directly to the central logging account's S3 bucket without needing intermediate services, aligning with AWS Organizations' centralized logging best practices.

Answer

Use Amazon Kinesis Data Firehose to stream logs to the central bucket.

Answer

Create a CloudWatch Logs subscription in the central account that receives logs from all accounts.

Answer

Create a CloudWatch Logs log group in each member account and use a subscription filter to forward to a central S3 bucket via Kinesis.

Question 9

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

Accepted Answer

Use AWS Config rules to detect public buckets and trigger an AWS Lambda function to make them private.. Option C is correct because AWS Config rules can continuously evaluate S3 bucket configurations against a custom or managed rule (e.g., 's3-bucket-public-read-prohibited'). When a bucket is detected as publicly accessible, the rule can invoke an AWS Lambda function via an Amazon CloudWatch Events event to automatically apply a bucket policy that removes public access, achieving automated remediation.

Answer

Use Amazon Inspector to scan for public buckets.

Answer

Use an SCP to deny making buckets public.

Answer

Use AWS CloudTrail to send alerts when a bucket becomes public.

Question 10

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

Accepted Answer

Use CloudWatch cross-account dashboards with a monitoring account.. CloudWatch cross-account dashboards allow you to create a single dashboard in a central monitoring account that displays metrics from multiple source accounts. This is the native AWS solution for centralized observability, requiring no additional data movement or custom code. The monitoring account uses the CloudWatch cross-account functionality to query metrics across accounts via IAM roles and the CloudWatch API.

Answer

Use AWS Config aggregator to view resources.

Answer

Use Amazon QuickSight with data sources from each account.

Answer

Use AWS CloudFormation StackSets to deploy dashboards in each account.

Question 11

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

Accepted Answer

Use an SCP with an Allow effect for allowed services.. Service control policies (SCPs) are the correct mechanism to centrally restrict which AWS services can be used across accounts in an AWS Organization. An SCP with an Allow effect explicitly permits only the specified services, while an SCP with a Deny effect blocks the specified services; both approaches achieve the goal of restricting service usage at the OU level. SCPs apply to all IAM users, roles, and root users in the member accounts, making them the appropriate tool for this requirement.

Answer

Use AWS CloudFormation StackSets to enforce service usage.

Answer

Use AWS Config rules to detect disallowed services.

Answer

Use IAM policies in each account to deny services.

Question 12

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records all AWS API calls made in an account, capturing the who, what, when, and source IP for every action. To centralize these logs from multiple accounts into a single location, you can configure CloudTrail to deliver log files to a centralized Amazon S3 bucket, and then use Amazon CloudWatch Logs to monitor, search, and alert on those API events in real time. Together, they provide a complete, centralized logging and monitoring solution for API activity across a multi-account environment.

Answer

Amazon GuardDuty

Answer

Amazon S3

Answer

AWS Config

Question 13

A company wants to implement a data perimeter to ensure that only authorized accounts can access their S3 buckets. Which TWO steps should they take?

Accepted Answer

Use SCPs to deny access from external accounts.. Option B is correct because bucket policy with aws:SourceAccount condition ensures only specific accounts. Option D is correct because SCPs can deny access from outside the organization. Option A is wrong because it's for CloudTrail. Option C is wrong because it's for VPC endpoints. Option E is wrong because it's for network perimeter, not account-level.

Answer

Use VPC endpoints with bucket policies.

Answer

Enable CloudTrail to log access.

Answer

Use AWS Network Firewall.

Question 14

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

Accepted Answer

Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.. Option B is correct because an SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.

Answer

Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.

Answer

Use S3 bucket policies to deny PutObject if encryption is not set.

Question 15

A company has a multi-account AWS environment with a central security account. They want to enable Amazon GuardDuty in all accounts and centrally view findings. The security team has already enabled GuardDuty in the security account and invited all member accounts. However, the security account is not receiving findings from all member accounts. Upon investigation, some member accounts show that GuardDuty is not enabled, and some show that they have not accepted the invitation. The team needs a scalable solution to enable GuardDuty across all accounts and ensure findings are sent to the security account. What should the team do?

Accepted Answer

Use the GuardDuty delegated administrator feature with AWS Organizations to automatically enable GuardDuty in all accounts and centralize findings.. Option D is correct because the GuardDuty delegated administrator feature integrated with AWS Organizations allows the security account to be designated as the GuardDuty administrator, which can then automatically enable GuardDuty for all existing and future member accounts in the organization. This eliminates the need for manual invitations and acceptances, ensuring that findings are centrally aggregated in the security account without requiring per-account configuration.

Answer

Use AWS Config rules to detect accounts without GuardDuty and send alerts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty resources in each account.

Answer

Use AWS Control Tower to enable GuardDuty in all accounts via a custom blueprint.