SAP-C02 Design Solutions for Organizational Complexity Practice Test 3 — 15 Questions

Question 1

Match each AWS migration service to its function.

Question 2

Match each AWS disaster recovery strategy to its description.

Question 3

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.. Option C is correct because AWS CloudFormation StackSets allow you to deploy stacks across multiple accounts and regions from a single template, which can be automated to apply to new accounts. Option A is wrong because Service Control Policies (SCPs) are used to restrict permissions, not to deploy resources. Option B is wrong because AWS Config aggregators only collect configuration data, not deploy resources. Option D is wrong because AWS Systems Manager is primarily for operational management, not automated resource deployment across accounts.

Answer

Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.

Answer

Use AWS Systems Manager Automation to apply the baseline to new accounts.

Answer

Use AWS Config aggregators to apply the baseline controls to new accounts.

Question 4

A company uses AWS Organizations with multiple OUs. The security team wants to prevent all accounts in the 'Production' OU from using non-compliant EC2 instance types, but allow exceptions for specific accounts. Which combination of controls should be used?

Accepted Answer

Use an SCP to deny non-compliant instance types at the OU level, and use resource-based policies on exception accounts to allow them.. Option D is correct because SCPs can deny access to non-compliant instance types at the OU level, and resource-based policies on the exception accounts can allow them to override the SCP. Option A is wrong because IAM policies alone are not effective when an SCP denies the action. Option B is wrong because AWS Config rules only detect, not block. Option C is wrong because tagging alone does not enforce instance type restrictions.

Answer

Use AWS Config rules to mark non-compliant instances and use AWS Lambda to terminate them.

Answer

Use resource tags to identify compliant instances and enforce via IAM conditions.

Answer

Use IAM policies to deny non-compliant instance types for the Production OU, and attach a different IAM policy to exception accounts.

Question 5

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

Accepted Answer

Use a shared VPC with separate subnets for each team, with IAM policies to control access.. Option B is correct because a shared VPC allows the central IT team to manage the network while application teams can create their own resources in the same VPC. Option A is wrong because individual VPCs per team would not allow central management. Option C is wrong because VPC peering does not provide central management. Option D is wrong because AWS Transit Gateway does not control resource creation permissions within VPCs.

Answer

Use AWS Transit Gateway to connect individual VPCs managed by each team.

Answer

Create a single VPC and use VPC peering to connect team resources.

Answer

Create a separate VPC for each application team and use VPC peering.

Question 6

A company has multiple AWS accounts and wants to centralize logging from all accounts to a single S3 bucket in a logging account. The logs must be encrypted with a KMS key managed by the logging account. What is the MOST secure way to allow cross-account S3 server access logs?

Accepted Answer

Use a bucket policy in the logging account that grants the S3 log delivery service principal access to write objects, and configure the KMS key policy to allow the log delivery service to use the key.. Option C is correct because the S3 bucket policy can grant cross-account permissions to the logging service principal, and the logging account's KMS key policy must allow the log delivery service to use the key. Option A is wrong because KMS key policies must explicitly allow the service to use the key. Option B is wrong because cross-account roles are not automatically used by S3 logging. Option D is wrong because the bucket policy alone does not handle KMS encryption.

Answer

Set the bucket policy to allow the source accounts to write logs, and enable default encryption on the bucket with the KMS key.

Answer

Create an IAM role in the logging account and allow the source accounts to assume it, then configure the source accounts to use that role for logging.

Answer

Configure the logging account's KMS key with a policy that allows the S3 service to use it, and set the bucket policy to allow the source accounts to write logs.

Question 7

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

Accepted Answer

Use AWS Organizations to register the member account as a delegated administrator for the service.. Option A is correct because AWS Organizations allows you to register a member account as a delegated administrator for a service, which then allows that service to perform cross-account actions. Option B is wrong because creating a service-linked role in each account is not necessary; the delegated administrator can create them on behalf of other accounts. Option C is wrong because the Organizations management account does not need to grant cross-account access; the service can do it. Option D is wrong because IAM roles in each account are not needed if the service supports delegated administration.

Answer

Create a service-linked role in each account to allow the service to perform actions.

Answer

Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.

Answer

Create an IAM role in each account with a trust policy that allows the service to assume it.

Question 8

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

Accepted Answer

Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.. Option C is correct because AWS SSO supports connecting to an existing Active Directory via AWS Directory Service for Microsoft Active Directory, which can be used as an identity source. Option A is wrong because AWS SSO does not directly integrate on-premises AD; it requires a directory in AWS. Option B is wrong because IAM Identity Center (successor to AWS SSO) also requires a directory. Option D is wrong because SAML 2.0 federation with on-premises AD is not a built-in AWS SSO feature; it requires a separate identity provider.

Answer

Use SAML 2.0 federation between AWS SSO and the on-premises AD.

Answer

Use AWS IAM Identity Center with an external identity provider that supports SCIM.

Answer

Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

Question 9

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

Accepted Answer

Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.. Option A is correct because the S3 bucket policy must allow the VPC Flow Logs service principal to write objects, and the KMS key policy must allow the same service principal to use the key. Option B is wrong because the source account's KMS key would not be used; the logging account's key encrypts the bucket. Option C is wrong because VPC Flow Logs do not use IAM roles for cross-account delivery; they use the bucket policy. Option D is wrong because the source account's bucket policy is irrelevant; the destination bucket is in the logging account.

Answer

Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

Answer

Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

Answer

In the source account, create a KMS key and allow the logging account to use it for encryption.

Question 10

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

Accepted Answer

Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.. Option B is correct because you can use an SCP to deny ec2:RunInstances if the request does not include the required tag. Option A is wrong because AWS Config can detect non-compliance but not prevent it. Option C is wrong because tagging is not automatic; it must be enforced. Option D is wrong because IAM policies in individual accounts can be overridden by SCPs, but SCPs are more effective for organization-wide enforcement.

Answer

Create an IAM policy in each account that requires the tag for ec2:RunInstances.

Answer

Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

Answer

Configure the EC2 service to automatically add the tag to all instances.

Question 11

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.. Option C is correct because AWS Organizations SCPs can restrict access to networking actions in specific accounts or OUs. Option A is wrong because IAM roles can be assumed by developers, but they don't prevent developers from using other roles. Option B is wrong because AWS Config is detective, not preventive. Option D is wrong because resource tags do not prevent actions.

Answer

Use IAM roles to grant developers access only to their own resources.

Answer

Use AWS Config rules to detect changes to networking resources.

Answer

Use resource tags to identify networking resources and apply IAM conditions.

Question 12

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.

Question 13

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 14

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Accepted Answer

Use separate AWS accounts for each environment to provide strong isolation.

Answer

Allow all users to assume cross-account roles for easier management.

Answer

Share the same VPC across all OUs to simplify networking.

Answer

Use resource tagging to isolate environments instead of accounts.

Question 15

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The policy denies all instance types except t3.micro and t3.small.. Option B is correct because the policy denies ec2:RunInstances for instance types that are not t3.micro or t3.small. Since t3.medium is not in the allowed list, the action is denied. Option A is wrong because the policy allows the action for allowed types. Option C is wrong because the condition is on instance type, not AMI. Option D is wrong because there is no explicit allow, but the default implicit deny is overridden by the explicit deny.

Answer

The policy has a syntax error that causes all actions to be denied.

Answer

The policy does not explicitly allow ec2:RunInstances.

Answer

The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.