SAP-C02 Design Solutions for Organizational Complexity Practice Test 31 — 15 Questions

Question 1

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.. An SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Answer

Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

Answer

Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

Answer

Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

Question 2

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.. CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.

Answer

Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.

Answer

Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.

Answer

Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.

Question 3

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

Accepted Answer

Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.. Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Answer

Use Amazon QuickSight to create dashboards from the flow logs.

Answer

Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

Answer

Load the flow logs into Amazon Redshift and run SQL queries.

Question 4

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon RDS

Question 5

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Accepted Answer

AWS CloudTrail can be configured to log management events across all accounts from the management account.. Option C is correct because AWS CloudTrail supports organization trails: when created in the management account (or a delegated administrator) with the organization setting enabled, it automatically logs management events for all member accounts and delivers them to a central S3 bucket. Option D is correct because service control policies (SCPs) are a core AWS Organizations feature that let you centrally set permission guardrails (allow lists or deny lists) that apply to all IAM principals in the accounts attached to the OU or root, restricting what member accounts can do. Option A is wrong because accounts can be moved between OUs at any time (though each account can belong to only one OU at a time). Option B is wrong because OUs are meant to group multiple accounts with similar policy needs, and isolation is achieved through separate accounts and SCPs, not by limiting an OU to a single account. Option E is wrong because SCPs can be attached to the organization root, OUs, and individual member accounts — not only to root accounts.

Answer

Accounts cannot be moved between OUs once created.

Answer

Each organizational unit (OU) should contain only one account for security isolation.

Answer

SCPs can only be applied to root accounts, not OUs.

Question 6

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Accepted Answer

Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.. Option A is correct because a cost allocation strategy requires a consistent, standardized tagging schema (such as CostCenter, Owner, and Project) so that costs can be grouped reliably, and AWS Config rules (e.g., required-tags managed rules) can detect and flag non-compliant resources to enforce that schema across accounts. Option E is correct because AWS Cost Explorer can filter and group costs by activated cost allocation tags, and when combined with AWS Organizations it provides cross-account visibility into tagged spend, which is essential for allocating costs across multiple accounts. Option B is wrong because AWS-generated tags are limited to specific service-created metadata and cannot substitute for a deliberate, standardized cost allocation tagging scheme. Option C is wrong because SCPs control which API actions and services principals may use; they cannot require that a resource carry specific tag keys or values. Option D is wrong because tags can be added, modified, or removed at any time after resource creation, not only at creation time.

Answer

Enable AWS-generated tags automatically for all resources.

Answer

Use service control policies (SCPs) to require tags on all resources.

Answer

Apply tags only at the resource creation time; they cannot be added later.

Question 7

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

Accepted Answer

An IAM role in the production account with a trust policy allowing the development account. Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.

Answer

A VPC peering connection between the accounts

Answer

A service control policy (SCP) that permits AssumeRole

Answer

An AWS Config rule to validate the role

Question 8

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

Accepted Answer

Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center. To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Answer

Create an IAM role in the member account with permissions to manage Identity Center

Answer

Attach an SCP to the member account allowing Identity Center actions

Answer

Create a new user in the management account with admin privileges

Question 9

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

Accepted Answer

Attach an SCP to the root OU that denies iam:CreateAccessKey. A Service Control Policy (SCP) attached to the root organizational unit denies the iam:CreateAccessKey action across all accounts in the organization, providing centralized enforcement. Option A is wrong because CloudTrail logs events but does not prevent them. Option B is wrong because applying an IAM policy in each account is not centrally managed and may be overridden by administrator permissions. Option D is wrong because AWS Config detects but cannot prevent the action, and the remediation Lambda may have a delay.

Answer

Enable AWS CloudTrail and set up a metric filter for CreateAccessKey

Answer

Apply an IAM policy to all users in each account that denies iam:CreateAccessKey

Answer

Use AWS Config to detect access key creation and trigger a Lambda to delete the key

Question 10

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

Accepted Answer

Share the portfolio with the target accounts from the Service Catalog console. AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Answer

Use AWS CloudFormation StackSets to deploy products to each account

Answer

Use SCPs to allow specific accounts to use Service Catalog

Answer

Create IAM roles in the central account that developers can assume

Question 11

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

Accepted Answer

Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.. It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Answer

Use AWS PrivateLink to route traffic through the NGFW.

Answer

Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Set up AWS Direct Connect between all VPCs and the inspection VPC.

Question 12

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

Accepted Answer

Use the management account to designate the member account as a delegated administrator for IAM Identity Center.. To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Answer

Enable AWS Organizations and create an admin role in the member account.

Answer

Create a new OU for the delegated administrator account.

Answer

Attach an SCP to allow IAM Identity Center actions in the member account.

Question 13

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Answer

AWS IAM

Answer

AWS Control Tower

Answer

AWS Service Catalog

Question 14

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Accepted Answer

S3 Object Lock. Amazon S3 (D) is the correct storage foundation because it provides durable, highly available object storage where the aggregated logs from all accounts can reside for the 7-year retention period. S3 Object Lock (B) is correct because it enforces WORM (write once, read many) immutability, using retention modes such as Compliance mode to prevent deletion or modification of log objects for the required duration. AWS CloudTrail (C) is correct because it captures API activity and account events across multiple AWS accounts, and with an organization trail it can deliver those logs centrally to the S3 bucket for compliance auditing. AWS Glue (A) is a serverless ETL/catalog service used for data preparation and transformation, not for immutable log retention, so it does not satisfy the requirement. Amazon Kinesis Data Streams (E) is a real-time streaming ingestion service and does not itself provide immutable, 7-year storage, so it is not part of the required combination.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 15

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Answer

Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.

Answer

Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.

Answer

Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.