SAP-C02 Design Solutions for Organizational Complexity Practice Test 30 — 15 Questions

Question 1

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

Accepted Answer

Use AWS Transit Gateway with VPN attachments between the central networking account and each member account VPC.. Option D is correct because AWS Transit Gateway with VPN attachments enables encrypted traffic between the central networking account and each member account VPC using IPsec tunnels. This satisfies the encryption-in-transit requirement while ensuring all traffic routes through the central networking account, preventing direct account-to-account access. Transit Gateway also allows all accounts to share a single VPC for workloads without creating separate VPCs.

Answer

Use AWS Client VPN to connect each account to the central VPC.

Answer

Use VPC Peering between the central VPC and each member account VPC.

Answer

Use AWS Direct Connect between accounts.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CloudFormation Guard to validate templates before deployment.. Option C is correct because AWS CloudFormation Guard (cfn-guard) allows you to define rules that validate CloudFormation templates before deployment. You can create a rule that checks whether the `BucketEncryption` property is set on every `AWS::S3::Bucket` resource, preventing the creation of unencrypted buckets at the template level. This enforces encryption as a policy-as-code gate in the CI/CD pipeline.

Answer

Use an IAM permissions boundary for all IAM roles.

Answer

Use S3 Block Public Access at the account level.

Answer

Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled.

Question 3

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

Accepted Answer

Enable the RI discount sharing feature in the management account.. Option B is correct because enabling RI discount sharing in the management account allows all accounts in the AWS Organization to benefit from Reserved Instance discounts, which is essential for accurate cost allocation across departments. Without this, RI discounts would only apply to the purchasing account, skewing department-level cost tracking.

Answer

Enable detailed billing reports in the management account.

Answer

Enable AWS Cost and Usage Reports (CUR) for each member account.

Question 4

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Accepted Answer

Use a service control policy that denies access to the unwanted services and attach it to the development OU.. Option A (attach SCP to the OU) and Option D (use a deny SCP for specific services) are correct. Option B is incorrect because tag policies don't restrict services. Option C is incorrect because IAM permissions boundaries do not override SCPs. Option E is incorrect because it would affect all OUs.

Answer

Apply a tag policy to the development OU that requires tags for all resources.

Answer

Modify the root-level SCP to deny the unwanted services.

Answer

Create an IAM permissions boundary for all users in the development OU.

Question 5

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

Accepted Answer

Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.. AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.

Answer

Deploy AWS CloudFormation StackSets to each account with security templates.

Answer

Create a shared services account and use IAM cross-account roles for each business unit.

Answer

Migrate all workloads to a single AWS account and use IAM roles for each business unit.

Question 6

A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Enable AWS CloudTrail in the management account with organization trail, and configure the trail to deliver logs to an S3 bucket in the management account.. Option D is correct because enabling an organization trail in the management account automatically applies CloudTrail to all accounts in the AWS Organization, delivering logs to a single S3 bucket in the management account without any per-account configuration or additional replication mechanisms. This meets the 7-year retention requirement with the least operational overhead, as the trail is centrally managed and logs are stored directly in the central bucket.

Answer

Enable CloudTrail in each account and use S3 Cross-Region Replication to copy logs to a central bucket.

Answer

Use Amazon Kinesis Data Firehose to stream CloudTrail logs from each account to a central S3 bucket.

Answer

Enable CloudTrail in each account individually and configure log file delivery to a bucket in that account.

Question 7

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

Accepted Answer

Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.. Option A is correct because AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Answer

Use IAM Access Analyzer to detect and report IAM user creation.

Answer

Use an SCP to deny iam:CreateUser across all accounts.

Answer

Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

Question 8

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a bucket in the logging account with a KMS key. Grant the necessary permissions to the VPC Flow Logs service in each account to write to that bucket using the KMS key. Enable VPC Flow Logs in each account to publish to the central bucket.. Option B is correct because it uses a central S3 bucket in the logging account with a customer-managed KMS key, which satisfies the encryption-at-rest requirement. By granting the VPC Flow Logs service principal in each account the necessary permissions to write to the central bucket and use the KMS key, logs are delivered directly without additional infrastructure. This approach minimizes operational overhead by avoiding replication, streaming services, or per-account bucket management.

Answer

Create a bucket in the logging account with default S3-managed encryption and enable VPC Flow Logs in each account to publish to that bucket.

Answer

Create a bucket in each account with KMS encryption and use S3 Cross-Region Replication to copy logs to the central bucket.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket with KMS encryption.

Question 9

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

Accepted Answer

Use Route 53 Resolver outbound endpoints and forwarding rules to forward DNS queries to the appropriate private hosted zones.. Option B is correct because Route 53 Resolver outbound endpoints allow you to forward DNS queries from your VPCs to custom DNS resolvers or to other private hosted zones. By creating outbound endpoints and forwarding rules, you can centrally route DNS queries from any VPC to the appropriate private hosted zone associated with another VPC, enabling cross-VPC DNS resolution without requiring VPC peering or complex associations.

Answer

Create VPC peering connections between all VPCs and enable the 'Allow DNS resolution from peered VPC' option.

Answer

Configure Route 53 Resolver inbound endpoints in each VPC and set up conditional forwarding.

Answer

Associate each private hosted zone with each VPC using Route 53.

Question 10

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

Accepted Answer

Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.. AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.

Answer

Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.

Answer

Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.

Question 11

A company has a global AWS environment with multiple VPCs in different regions. The company uses AWS Transit Gateway to connect VPCs in the same region, but they need to interconnect VPCs across regions. The network team wants a solution that provides transitive routing across regions with minimal latency and operational overhead. Which solution should be implemented?

Accepted Answer

Use Transit Gateway peering attachments between Transit Gateways in different regions.. Transit Gateway peering attachments enable transitive routing between Transit Gateways in different AWS regions, providing low-latency connectivity over the AWS global network without requiring VPN or Direct Connect. This solution minimizes operational overhead because AWS manages the peering connection and route propagation automatically, allowing VPCs attached to different Transit Gateways to communicate across regions.

Answer

Set up a VPN connection between Transit Gateways in different regions.

Answer

Use AWS Direct Connect to connect the Transit Gateways in different regions.

Answer

Create VPC peering connections between all VPCs in different regions.

Question 12

A company uses AWS Organizations and has a requirement that all Amazon S3 buckets must have versioning enabled. The company wants to automatically enable versioning on any bucket that is created without it. Which solution should be implemented?

Accepted Answer

Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.. Option A is correct because AWS Config can detect S3 buckets without versioning using the managed rule `s3-bucket-versioning-enabled`, and then automatically remediate the noncompliant resource by invoking an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven solution that meets the requirement without manual intervention or blocking bucket creation.

Answer

Use an SCP to deny s3:CreateBucket unless versioning is enabled.

Answer

Use AWS Config to detect buckets without versioning and send an SNS notification.

Answer

Use AWS CloudFormation StackSets to deploy a bucket with versioning enabled in each account.

Question 13

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

Accepted Answer

Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.. AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.

Answer

Use an SCP to require that all IAM roles trust the corporate IdP.

Answer

Create IAM roles in each account with a trust policy that allows the corporate IdP.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.

Question 14

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.. Option C is correct because the AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Answer

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Answer

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Answer

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Question 15

A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?

Accepted Answer

Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.. Option D is correct because enabling an organization trail in CloudTrail from the management account automatically applies to all accounts in the AWS Organization, delivering logs to a central S3 bucket with minimal per-account configuration. Using CloudWatch Logs with metric filters on that S3 bucket allows the security team to create a central CloudWatch dashboard that monitors API activity across all accounts, satisfying the requirement with the least operational overhead.

Answer

Use Amazon EventBridge to capture API calls from all accounts and route them to a central CloudWatch Logs group.

Answer

Enable CloudTrail in each account and configure the trail to send logs to a CloudWatch Logs group in that account. Then create a cross-account CloudWatch dashboard.

Answer

Use CloudWatch cross-account observability to aggregate logs from all accounts into a single monitoring account.