SAP-C02 Design Solutions for Organizational Complexity Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is not passing the MFA serial number and token code in the assume-role API call.. The IAM role trust policy includes a condition that checks for the presence of both `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge`. Even though the user has MFA enabled and is passing the MFA token, the `aws:MultiFactorAuthSerialNumber` and `aws:MultiFactorAuthTokenCode` parameters must be explicitly included in the `sts:AssumeRole` API call. Without these, the condition evaluates to false, resulting in an 'AccessDenied' error.

Answer

The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.

Answer

The role requires MFA, but the user's MFA device is not configured correctly.

Answer

The principal is set to the root account, which does not allow IAM users to assume the role.

Question 2

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.. AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Answer

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Answer

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Answer

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Question 3

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Accepted Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.. The `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to traffic originating from specific VPC endpoints (interface or gateway endpoints). This ensures that only requests coming through approved VPC endpoints can access the data lake, directly enforcing the mandate that access must originate from approved VPCs.

Answer

Enable S3 Block Public Access at the account level.

Answer

Use AWS Certificate Manager to issue certificates for S3 bucket access.

Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.

Question 4

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Answer

AWS Config rules with auto-remediation

Answer

AWS Service Catalog with a portfolio of approved AMIs

Answer

AWS Identity and Access Management (IAM) policies in each account

Question 5

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.. AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Answer

Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.

Answer

Set up AWS Direct Connect gateway and route all traffic through the security account.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.

Question 6

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

Accepted Answer

Apply tags to resources and enable cost allocation tags in Billing and Cost Management.. Applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Answer

Use Cost Explorer to filter by linked account, which automatically groups by business unit.

Answer

Use AWS Budgets to create budgets per account and manually aggregate.

Answer

Create a separate payer account for each business unit.

Question 7

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

Accepted Answer

Use an SCP to deny the iam:UpdateAccountPasswordPolicy action and deploy a password policy using CloudFormation StackSets.. An SCP can deny the iam:UpdateAccountPasswordPolicy action, preventing member accounts from altering the password policy, while CloudFormation StackSets can deploy a compliant password policy across all member accounts automatically. This combination provides a preventive control that enforces the minimum 14-character requirement without relying on user action or reactive detection.

Answer

Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

Answer

Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

Answer

Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

Question 8

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Accepted Answer

Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.. Partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Answer

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Answer

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Answer

Use Athena with federated query to scan logs directly from the application accounts.

Question 9

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

Accepted Answer

Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.. AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Answer

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Answer

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Answer

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Question 10

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

Accepted Answer

Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.. It combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Answer

Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

Answer

Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

Answer

Use AWS Trusted Advisor to check for root user usage and generate a weekly report.

Question 11

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Accepted Answer

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Answer

Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

Answer

Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

Answer

Enable AWS Resource Access Manager to share resources only with trusted accounts.

Question 12

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 13

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

Accepted Answer

Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.. Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.

Answer

Increase the size of the firewall instances to larger instance types to handle more traffic per instance.

Answer

Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.

Answer

Configure the auto-scaling group to use a step scaling policy based on network throughput.

Question 14

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.. The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Answer

The CloudWatch Logs subscription filter does not have permissions to write to Firehose.

Answer

The OpenSearch cluster's access policy denies write access from the Firehose stream.

Answer

The Firehose delivery stream does not have a TLS certificate configured.

Question 15

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Accepted Answer

Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.. Establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Answer

Configure an IAM identity provider to use the on-premises Active Directory.

Answer

Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

Answer

Deploy AWS Managed Microsoft AD in each account and configure replication.