SAP-C02 Design Solutions for Organizational Complexity Practice Test 32 — 15 Questions

Question 1

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.. Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Answer

Use AWS Config rules to detect and automatically delete any new users or keys.

Answer

Enable AWS CloudTrail and create a metric filter to alert on these actions.

Answer

Attach an IAM policy to the Administrator role in each account that denies these actions.

Question 2

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.. Option A is correct because CloudFormation StackSets can deploy AWS Config rules (e.g., required-tags) across all accounts in an AWS Organization from a single administrator account, providing centralized, continuous detection of non-compliant EC2 instances and their tags. Option D is correct because an SCP attached to the organization's root or OUs can enforce tagging standards preventively by denying ec2:RunInstances when the required tag keys/values are absent (using conditions such as aws:RequestTag and aws:TagKeys), blocking non-compliant launches across all member accounts. Option B is not correct because Service Catalog constraints (e.g., TagOptions) only apply to products launched through the catalog, not to all EC2 instances across accounts. Option C is not correct because AWS Resource Access Manager shares resources such as subnets, Transit Gateways, and Route 53 Resolver rules, not tagging policies. Option E is not correct because Auto Scaling lifecycle hooks pause instances during launch/termination for custom actions and do not enforce or automatically add tags to meet organization-wide tagging standards.

Answer

Use AWS Service Catalog to enforce tagging on EC2 products.

Answer

Use AWS Resource Access Manager to share a tagging policy across accounts.

Answer

Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

Question 3

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Accepted Answer

Create an AWS Config aggregator in the security account to view compliance status across accounts.. Option B is correct because an AWS Config aggregator in the security account collects configuration and compliance data from multiple accounts and Regions, giving a centralized view of compliance status across the organization. Option C is correct because CloudFormation StackSets deploy the same AWS Config rules (and related resources) consistently to all target accounts and Regions in the organization. Option D is correct because AWS Config must be enabled in each account and Region before rules can evaluate resources and report compliance there. Option A is not correct because an SCP can restrict or require actions but does not itself enable AWS Config or enforce rule compliance. Option E is not correct because AWS CloudTrail records API activity and does not evaluate resource configuration compliance against Config rules.

Answer

Apply a service control policy (SCP) that requires AWS Config to be enabled.

Answer

Use AWS CloudTrail to monitor compliance status.

Question 4

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

Accepted Answer

Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity. Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Answer

Apply a service control policy to allow cross-account access

Answer

Create an IAM user in the production account and share the credentials with the development team

Answer

Configure security group rules to allow access from the development account

Question 5

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 6

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account

Question 7

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

Accepted Answer

Delegated administrator for AWS services. Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Answer

AWS Control Tower

Answer

Cross-account IAM roles

Answer

AWS CloudTrail organization trail

Question 8

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

Accepted Answer

Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Answer

Create VPC peering connections between all VPCs and use security groups for inspection

Answer

Configure a VPN between each VPC and a central virtual appliance

Answer

Use AWS Direct Connect to connect all VPCs to a common router

Question 9

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that is enabled for all accounts. AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Answer

Configure each account's CloudTrail to send logs to a central CloudWatch Logs group

Answer

Create a CloudTrail trail in each account and deliver logs to the same S3 bucket

Answer

Use S3 replication to copy logs from individual account buckets to a central bucket

Question 10

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Accepted Answer

Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager. AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Answer

Deploy VPC endpoints in each account for communication

Answer

Establish VPC peering connections between each account and the central networking account

Answer

Set up AWS Direct Connect between all accounts

Question 11

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Accepted Answer

Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization. The correct answers are E and D. First, you must designate a member account as the GuardDuty delegated administrator (option E) using the Organizations management account, which grants that account administrative authority over GuardDuty for the entire organization. Then, from that delegated administrator account, you enable GuardDuty for all accounts in the organization (option D), which automatically enables GuardDuty in every existing and newly added member account. Option A is incorrect because CloudFormation StackSets is not the mechanism GuardDuty uses for organization-wide enablement. Option B is incorrect because manual per-account enablement defeats the purpose of centralized management. Option C is incorrect because service control policies restrict permissions and cannot force a service like GuardDuty to be enabled.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in each account

Answer

Enable GuardDuty manually in each member account by logging into each account

Answer

Create a service control policy to force GuardDuty to be enabled

Question 12

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Accepted Answer

The subnet's auto-assign public IP setting is disabled. The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Answer

The internet gateway is not attached to the VPC

Answer

The subnet needs a NAT gateway for internet access

Answer

The subnet's route table does not have a route to the internet gateway

Question 13

A multinational company is adopting AWS Organizations to manage multiple accounts across business units. The security team requires that specific IAM roles be automatically deployed to all existing and future member accounts. Which solution should the company use?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment enabled in the organization.. AWS CloudFormation StackSets with automatic deployment enabled allows you to deploy IAM roles across all accounts in an AWS Organization, including future accounts, by specifying the organization root or OUs as targets. This ensures consistent role creation without manual intervention, as StackSets automatically provisions stacks in new accounts as they join the organization.

Answer

Use AWS Config rules to enforce the role creation in each account.

Answer

Use AWS Service Catalog to create a portfolio with the IAM role product and share it with all accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create the role in each account.

Question 14

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway (D) is the correct service because it acts as a central hub that can route traffic between multiple VPCs across different accounts, and it supports route tables that can force all inter-VPC traffic through a dedicated inspection VPC (e.g., using a blackhole route or a network appliance). This enables transitive routing without requiring full mesh peering, and it integrates with AWS Resource Access Manager (RAM) for cross-account sharing.

Answer

AWS Direct Connect gateway

Answer

VPC peering with full mesh connectivity

Answer

Elastic Load Balancer

Question 15

A company has a management account in AWS Organizations and wants to share a central Amazon VPC subnet with multiple member accounts for a shared services VPC. Which AWS service should be used to share the subnet?

Accepted Answer

AWS Resource Access Manager. AWS Resource Access Manager (RAM) is the correct service because it enables you to share a central VPC subnet from a management account with multiple member accounts in AWS Organizations without requiring VPC peering or transit gateways. With RAM, you create a resource share that includes the subnet and specify the member accounts or organizational units (OUs) to grant them access, allowing those accounts to launch resources directly into the shared subnet while maintaining centralized network management.

Answer

VPC peering connection

Answer

AWS PrivateLink

Answer

Service control policy