SAP-C02 Design Solutions for Organizational Complexity Practice Test 3 — 15 Questions

Question 1

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.. A service control policy (SCP) can deny the s3:CreateBucket action unless the request includes a 'CostCenter' tag, using the 'aws:RequestTag' condition key. This enforces tagging at the point of creation across all accounts in the organization, preventing untagged buckets from being created in the first place, which is the most operationally efficient approach as it avoids the need for remediation or post-creation tagging.

Answer

Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

Answer

Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

Question 2

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

Accepted Answer

Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.. Using a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization (C) meets the requirements because it provides a single KMS key for encryption across accounts, and the key policy can grant permissions to the entire organization via AWS Organizations. This simplifies key management and ensures that all accounts can use the same key for S3 encryption. SSE-KMS with a customer managed key also provides encryption at rest and allows for audit trails via CloudTrail.

Answer

Use SSE-S3 encryption. Grant cross-account access via bucket policy.

Answer

Use SSE-C encryption. Provide the same customer key to all accounts.

Answer

Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

Question 3

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.. SCPs provide preventive, account-level enforcement that blocks unauthorized EC2 instance launches before they occur, while CloudFormation hooks add a second layer of preventive control at the infrastructure-as-code level. This combination is the most scalable for 500+ accounts because SCPs are applied centrally via AWS Organizations and CloudFormation hooks operate at deployment time, ensuring no non-compliant instance is ever created.

Answer

Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

Answer

Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 4

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

Accepted Answer

Use Amazon Athena with Lambda User-Defined Functions (UDFs) to redact data during query execution.. Amazon Athena with Lambda UDFs allows you to redact sensitive IP addresses at query time without modifying the underlying data in S3. This approach is highly scalable as it leverages Athena's serverless query engine and Lambda's stateless compute, enabling on-the-fly redaction across petabytes of VPC Flow Logs stored centrally in the logging account.

Answer

Create a Lambda function in each member account to redact logs before delivery.

Answer

Use S3 Object Lambda to redact sensitive data when objects are read.

Answer

Use Amazon Kinesis Data Firehose to transform data before writing to S3.

Question 5

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

Accepted Answer

Create a backup vault in the management account and share it with member accounts.. Option C is correct because AWS Backup cross-account backup requires a destination backup vault in the management (or central) account that is shared with member accounts via the vault access policy, enabling member accounts to copy backups into the centralized vault. Option E is correct because AWS Backup must be enabled as a trusted service in AWS Organizations so that backup policies can be centrally deployed and managed across all member accounts from the management account. Option A is incorrect because AWS Backup uses the service-linked role AWSServiceRoleForBackup and Organizations-managed policies rather than manually created IAM roles in each member account. Option B is incorrect because the entire point of centralized management is a single backup policy applied through Organizations, not separate per-account policies. Option D is incorrect because AWS Config is a compliance and configuration tracking service, not a mechanism for aggregating backup vaults.

Answer

Create IAM roles in each member account to allow AWS Backup to assume them.

Answer

Create a separate backup policy for each member account.

Answer

Create a backup vault in each member account and aggregate them using AWS Config.

Question 6

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

Accepted Answer

Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.. Option A is correct because a Transit Gateway acts as a central hub that connects multiple VPCs across accounts, and attaching each VPC to it with proper route table entries enables scalable, transitive routing between member VPCs and the shared services VPC hosting the RDS instance. Option C is correct because once network connectivity exists, the RDS instance's security group must explicitly permit inbound traffic on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL) from the member VPC CIDR ranges, which enforces least-privilege access at the instance level. Option B is not appropriate because a Lambda proxy adds unnecessary complexity and latency rather than providing native network connectivity for database traffic. Option D is wrong because making RDS publicly accessible exposes the database to the internet and IAM authentication alone does not secure network-level access. Option E is not the best choice for a multi-account architecture with many member VPCs, since VPC peering is non-transitive and would require a full mesh of connections, whereas a Transit Gateway scales more cleanly.

Answer

Use AWS Lambda to proxy database requests from member accounts.

Answer

Make the RDS instance publicly accessible and use IAM authentication.

Answer

Create a VPC peering connection between each member VPC and the shared services VPC.

Question 7

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Accepted Answer

Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.. Option A is correct because a Lambda function triggered by CloudTrail events can implement the approval workflow by automatically applying the 'Approved' tag to roles only after they pass the required approval process, which is the mechanism that satisfies the tag condition enforced elsewhere. Option B is correct because an SCP with a Deny for iam:CreateRole unless aws:RequestTag/Approved is present enforces least privilege at the Organizations level, preventing any role creation that lacks the approval tag across all accounts in the organization. Option E is correct because AWS Config rules can evaluate IAM roles against the required 'Approved' tag and flag non-compliant roles, providing continuous detection and enforcement visibility for the least-privilege model. Option C is not correct because CloudFormation StackSets only deploy IAM roles consistently across accounts; they do not enforce an approval workflow or block unapproved role creation. Option D is not correct because enabling CloudTrail only records IAM role creation events for auditing; logging alone does not prevent or require approval for role creation.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

Answer

Enable AWS CloudTrail to log all IAM role creation events.

Question 8

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Accepted Answer

Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.. Option A is correct because Route 53 Resolver outbound endpoints in each spoke VPC are needed to forward DNS queries from those VPCs to the central resolver in the shared services VPC; outbound endpoints send queries to target IP addresses, which would be the central resolver's inbound endpoint. Option B is correct because a Transit Gateway provides the network connectivity between all VPCs and the shared services VPC, allowing the outbound endpoint traffic to reach the central resolver's inbound endpoint IP addresses. Option C is correct because the Route 53 private hosted zones must be associated with the shared services VPC so that the central resolver can resolve the records for the zones on behalf of the other accounts. Option D is not correct because, while an inbound endpoint in the shared services VPC would be part of a full design, the question asks for components required to forward queries to a central resolver, and the marked correct answers describe the outbound endpoints, connectivity, and hosted zone association; inbound endpoints are not among the marked correct options. Option E is not correct because VPC peering is an alternative connectivity method, but the scenario specifies a Transit Gateway as the required connectivity component, and peering is not marked correct.

Answer

Route 53 Resolver inbound endpoints in the shared services VPC.

Answer

VPC peering connections between each VPC and the shared services VPC.

Question 9

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

Accepted Answer

The principal should be the CloudTrail service principal, not the root account of 111111111111.. The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Answer

The resource ARN is incorrect.

Answer

The bucket policy requires the x-amz-acl header, which CloudTrail does not set.

Answer

The bucket policy does not allow s3:PutObject for the account 222222222222.

Question 10

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

Accepted Answer

The SCP applies to the production account because it is attached to the root.. SCPs are applied to all accounts in the organization when attached to the root, including the production account. The SCP denying s3:DeleteBucket is an effective deny that overrides any allow in IAM policies, so the production account's administrator cannot delete the bucket regardless of their IAM permissions.

Answer

The production account's IAM policy denies s3:DeleteBucket.

Answer

The SCP only applies to the management account.

Answer

The production account is the management account.

Question 11

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

Accepted Answer

Use AWS Config rules to check AMI IDs against a parameter store and auto-remediate.. AWS Config rules can evaluate EC2 instances against a centrally managed list of approved AMI IDs stored in AWS Systems Manager Parameter Store, and auto-remediate non-compliant instances (e.g., by terminating or stopping them). This approach is scalable across multiple accounts via AWS Config aggregator and cross-account IAM roles, and it is secure because it enforces compliance continuously without relying on client-side IAM policies that can be bypassed.

Answer

Tag approved AMIs and use IAM policies to require that tag.

Answer

Use an IAM policy in each account to allow only specific AMI IDs.

Answer

Use an SCP to deny ec2:RunInstances unless the AMI ID matches an approved list.

Question 12

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

Accepted Answer

Use AWS Organizations with a delegated administrator for IAM.. AWS Organizations allows you to centrally manage multiple accounts and designate a delegated administrator for IAM. This enables the centralized IT team to create and manage IAM roles across all member accounts without granting full administrator access, as the delegated administrator can perform IAM actions within the scope defined by service control policies (SCPs) and IAM permissions.

Answer

Use AWS Single Sign-On with permission sets.

Answer

Create an IAM user in each account with AdministratorAccess.

Answer

Use cross-account roles with a policy that allows iam:CreateRole.

Question 13

A company uses AWS Organizations with multiple accounts. They want to centralize VPC flow logs for all VPCs across accounts. The logs should be stored in a central S3 bucket in the management account. What is the MOST efficient way to achieve this?

Accepted Answer

Use a bucket policy on the central S3 bucket to allow cross-account delivery from all accounts.. A bucket policy on the central S3 bucket can grant the necessary permissions for VPC Flow Logs from any account in the organization to be delivered directly to that bucket. This approach avoids the overhead of managing individual delivery configurations and leverages AWS Organizations to simplify cross-account permissions, making it the most efficient centralized solution.

Answer

Enable VPC flow logs at the organization level using CloudTrail.

Answer

Create a flow log in each account and configure it to deliver to a central S3 bucket.

Answer

Use CloudWatch Logs in each account and stream to a central log group.

Question 14

A company is using AWS Organizations with hundreds of accounts. They need to ensure that no account can modify the VPC default security group. Which SCP should they apply to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroup*","Resource":"*"}]}. Which denies all ec2:ModifySecurityGroup* actions on any security group. This ensures that no account can modify the default security group, as required. Option C is incorrect because it only denies the ec2:ModifySecurityGroupRules action and uses a condition that applies to all VPCs, not specifically the default security group. Option A only prevents deletion, not modification. Option D prevents creation but not modification.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:DeleteSecurityGroup","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroupRules","Resource":"arn:aws:ec2:*:*:security-group/*","Condition":{"StringEquals":{"ec2:Vpc":"arn:aws:ec2:*:*:vpc/*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateSecurityGroup","Resource":"*"}]}

Question 15

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}. The correct policy uses a Deny effect with a condition that checks if the tag 'CostCenter' is null (i.e., not provided) at the time of the RunInstances request. The condition 'Null': {'aws:RequestTag/CostCenter': 'true'} evaluates to true when the tag key is absent, so the Deny applies and blocks the launch. This enforces that the tag must be included.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}