SAP-C02 Design Solutions for Organizational Complexity Practice Test 30 — 15 Questions

Question 1

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a StackSet with the template and target the OU, enabling automatic deployment.. Option B is correct because the common resources (VPCs, subnets, security groups) must first be codified in an AWS CloudFormation template, which serves as the reusable artifact for automated, consistent deployment across accounts. Option D is correct because CloudFormation StackSets must be granted trusted access with AWS Organizations so the management account can deploy stack instances into member accounts and target OUs directly. Option A is correct because creating a StackSet from that template and targeting the specific OU with automatic deployment enabled ensures existing accounts receive the resources and any new account added to the OU is provisioned automatically. Option C is incorrect because AWS Config rules only detect and evaluate resource compliance; they do not natively deploy resources, and using Lambda for remediation is a custom, reactive approach rather than the automated StackSet mechanism required. Option E is incorrect because an SCP only sets permission guardrails (allowing or denying actions); it cannot create or require the actual provisioning of VPCs, subnets, or security groups.

Answer

Use AWS Config rules to detect missing resources and deploy them via Lambda.

Answer

Create an SCP that requires the creation of those resources.

Question 2

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 3

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 4

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

Accepted Answer

AWS IAM Identity Center (AWS SSO).. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user identities and permissions across multiple AWS accounts within an AWS Organization. It allows the security team to create or connect users and groups, and assign them fine-grained permissions to accounts, roles, and applications from a single pane of glass, eliminating the need to create IAM users in each account.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

AWS Identity and Access Management (IAM) in the management account.

Answer

Amazon Cognito user pools.

Question 5

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

Accepted Answer

Some accounts have manually created resources that conflict with the stack set template's resources.. StackSets deploy a common template across accounts. If a resource defined in the template (e.g., a subnet with a specific CIDR) already exists in an account due to manual creation or prior configuration, the update fails with a 'resource already exists' error. Option A is incorrect because OU configuration affects initial deployment, not updates, and the error is about resource conflict, not OU coverage. Option C is incorrect because IAM permissions would cause an 'access denied' error, not a resource conflict. Option D is incorrect because drift detection does not prevent updates; it only reports differences.

Answer

The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

Answer

The network team does not have sufficient IAM permissions to update stacks in those accounts.

Answer

The stack set was previously drift-detected and the drift is preventing updates.

Question 6

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 7

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

Accepted Answer

Apply an SCP to the production OU that denies all actions to non-approved IAM roles.. Option B is correct because AWS Organizations Service Control Policies (SCPs) applied at the production OU level set the maximum permissions for all accounts within that OU, so a deny statement targeting non-approved IAM roles (for example, denying all actions unless the principal is an approved role) blocks developers from deploying in production while leaving development and testing OUs unaffected. Option D is correct because creating production IAM roles with no permissions and allowing only a central CI/CD role to assume a privileged role enforces least privilege and separation of duties, ensuring developers cannot directly deploy to production and only the controlled pipeline can. Option A is not correct because CloudTrail only records and can alert on API activity after the fact; it is detective, not preventive, so it does not stop developers from deploying to production. Option C is not correct because resource tags combined with SCPs are not a reliable enforcement mechanism for this requirement; SCPs do not evaluate resource tags for most services, and tag-based authorization is better handled with IAM policies and conditions, not as the primary control here. Option E is not correct because AWS Config rules are detective controls that flag noncompliant resources after deployment, not preventive controls that block deployments.

Answer

Enable AWS CloudTrail to monitor and alert on production changes.

Answer

Use resource tags to identify development and production resources and enforce policies via SCPs.

Answer

Use AWS Config rules to detect unauthorized deployments in production.

Question 8

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

Accepted Answer

Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.. Using AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type allows automatic discovery of new partitions as new accounts are added. The crawler can be scheduled to run periodically, updating the table metadata without manual intervention. Partition indexing improves query performance by reducing the amount of data scanned. Option A is incorrect because updating a view requires manual DDL changes each time a new account is added. Option C is incorrect because manually managing partitions and using MSCK REPAIR TABLE still requires manual effort to add new partitions. Option D is incorrect because converting logs to Parquet adds overhead and does not solve the need for automatic partition discovery across accounts.

Answer

Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

Answer

Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

Answer

Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

Question 9

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

Accepted Answer

Create separate AWS accounts for each environment using AWS Organizations.. AWS best practice for isolating environments is to use separate AWS accounts for each environment (development, testing, production) managed under AWS Organizations. This provides strong security boundaries, simplifies billing, and allows for centralized governance and service control policies (SCPs).

Answer

Use separate VPCs within the same account.

Answer

Use IAM policies to restrict access per environment.

Answer

Use resource tagging to separate environments.

Question 10

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

Accepted Answer

Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.. Using the `aws:PrincipalOrgID` condition key in an S3 bucket policy allows you to grant access to all principals (users, roles) within your AWS Organization without needing to list individual account IDs. This approach is both secure (no public access) and scalable (automatically includes new accounts added to the organization).

Answer

Make the bucket public with read-only access.

Answer

Generate presigned URLs for each account to access the bucket.

Answer

Create IAM roles in each account with permissions to assume a role in the central account.

Question 11

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.. Option B is correct because an SCP attached at the organization, OU, or account level in AWS Organizations can explicitly deny the CloudTrail actions that stop or delete a trail (for example cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail), which centrally prevents any principal in member accounts from disabling CloudTrail. Option D is correct because AWS Config can evaluate CloudTrail configuration with a managed rule such as cloudtrail-enabled and trigger automatic remediation (for example via SSM Automation) to re-enable logging if a trail is stopped or deleted, restoring the desired state. Option A is not correct because Trusted Advisor only provides advisory checks and alerts; it cannot enforce or prevent the disabling of CloudTrail. Option C is not correct because AWS Shield Advanced is a DDoS protection service and has no role in controlling CloudTrail configuration. Option E is not correct because IAM permissions boundaries only limit the maximum permissions of an IAM entity and do not by themselves enforce organization-wide denial of CloudTrail changes across all accounts.

Answer

Use AWS Trusted Advisor to alert when CloudTrail is disabled.

Answer

Use AWS Shield Advanced to protect CloudTrail.

Answer

Use IAM permissions boundaries to restrict user permissions.

Question 12

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

Accepted Answer

The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.. SCPs apply to all principals in the account, including administrators, and deny actions even if IAM policies allow them. Since the SCP denies s3:PutBucketPolicy, the development team cannot create the bucket policy despite having full admin access. Option A is incorrect because the team does have IAM permissions (admin), but the SCP overrides them. Option C is incorrect because CloudFormation's service role is not the issue; the SCP restriction affects all principals, including CloudFormation. Option D is incorrect because the trust policy of the production account's IAM roles is unrelated to the SCP in the development account.

Answer

The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.

Answer

CloudFormation service role is missing. They need to create a service role with appropriate permissions.

Answer

The production account's IAM roles are not trusted. They need to update the trust policy.

Question 13

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

Accepted Answer

SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.. The most likely reason is option C: SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters. SCPs do not have visibility into the current configuration of resources like S3 bucket versioning. Therefore, an SCP that attempts to deny PutBucketVersioning if versioning is not enabled cannot work because it cannot check the bucket's current versioning status. This allows users to disable versioning. Option A is incorrect because SCPs are hierarchical and cannot be overridden by another SCP unless there is an explicit allow, but the core issue is the condition evaluation. Option B is incorrect because SCPs use explicit deny, not a default deny. Option D is incorrect because applying the SCP to the root OU would not resolve the fundamental limitation that SCPs cannot check resource state.

Answer

The SCP is overridden by a service control policy that allows the action.

Answer

The SCP does not have an explicit deny; it uses a default deny.

Answer

The SCP is not applied to the root organizational unit.

Question 14

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to use AWS Transit Gateway to connect VPCs across accounts. The network team has created a Transit Gateway in the network account and shared it using AWS Resource Access Manager (RAM) with the workload accounts. The workload accounts have created VPC attachments to the Transit Gateway. However, traffic is not flowing between the VPCs. The route tables in the workload VPCs have routes pointing to the Transit Gateway. What is the most likely cause?

Accepted Answer

The Transit Gateway route tables do not have routes for the attached VPCs.. For traffic to flow between VPCs attached to a Transit Gateway, the Transit Gateway route tables must have routes for the attached VPC CIDRs. When a VPC is attached, a route to the VPC is not automatically added to the Transit Gateway route table unless route propagation is enabled or a static route is created. The most likely cause is that the Transit Gateway route tables lack routes for the attached VPCs, preventing traffic from being forwarded between them.

Answer

The Transit Gateway is in a different AWS account, so route propagation is not automatic.

Answer

The security groups in the workload VPCs are blocking traffic.

Answer

VPC flow logs are not enabled.

Question 15

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

Accepted Answer

Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.. AWS Config conformance packs can be deployed across all accounts in an AWS Organization using the AWS Organizations integration. Conformance packs allow you to deploy a collection of AWS Config rules and remediation actions consistently. Option B is incorrect because the AWS Config aggregator only provides a central view of compliance status; it does not automatically enable rules in member accounts. Option C is incorrect: while CloudFormation StackSets can deploy Config rules, conformance packs are the recommended and more straightforward method for deploying Config rules across an organization. Option D is incorrect because SCPs (Service Control Policies) are used to manage permissions and cannot directly enforce AWS Config rules.

Answer

Use the AWS Config aggregator to manually enable the rule in each account.

Answer

Use AWS CloudFormation StackSets to deploy a Config rule template to each account.

Answer

Create an SCP that requires all accounts to enable AWS Config.