SAP-C02 Design Solutions for Organizational Complexity Practice Test 33 — 15 Questions

Question 1

A company wants to centrally manage backups for Amazon EBS volumes across multiple AWS accounts. They need a solution that can automatically back up volumes based on tags, retain backups according to a policy, and send notifications on failures. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a centralized, policy-based backup solution for Amazon EBS volumes across multiple AWS accounts. It supports tag-based backup policies, retention rules, and integrates with Amazon CloudWatch Events and Amazon SNS to send notifications on failures, meeting all the stated requirements.

Answer

AWS CloudFormation StackSets

Answer

Amazon RDS automated backups

Answer

Amazon S3 lifecycle policies

Question 2

A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect (A) is correct because it provides a dedicated private network connection from the on-premises data center to AWS, bypassing the public internet for consistent, low-latency private connectivity. AWS Transit Gateway (D) is correct because it acts as a central hub that connects multiple VPCs across different AWS accounts and attaches to the Direct Connect gateway, enabling transitive routing between all VPCs and on-premises. Together, Direct Connect provides the private on-premises link while Transit Gateway provides scalable many-to-many VPC interconnection across accounts. Amazon Route 53 Resolver (B) only handles DNS resolution between on-premises and VPCs and does not provide the private network transport itself. VPC peering (C) connects only two VPCs at a time and does not scale to a hub-and-spoke multi-account topology or integrate natively with on-premises routing. AWS Client VPN (E) is a remote-user VPN solution for individual clients, not for site-to-site private connectivity between VPCs and a data center.

Answer

Amazon Route 53 Resolver

Answer

VPC peering

Answer

AWS Client VPN

Question 3

A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which TWO steps are required to achieve this?

Accepted Answer

Create a new CloudTrail trail in the management account with organization trail enabled.. Option C is correct because creating a CloudTrail trail in the management account with the organization trail feature enabled automatically applies the trail to all accounts in the AWS Organization, capturing events across every member account without configuring each one separately. Option D is correct because the trail must be configured to deliver its log files to a central S3 bucket located in the management account, which fulfills the requirement of a single centralized logging destination. Option A is incorrect because an AWS Config rule only evaluates and reports on configuration compliance; it does not collect or centralize CloudTrail logs. Option B is incorrect because an SCP governs the maximum available permissions for accounts but does not itself create trails or deliver logs to S3. Option E is incorrect because enabling CloudTrail individually in each member account is unnecessary and contrary to the centralized organization trail approach.

Answer

Create an AWS Config rule to monitor CloudTrail configuration.

Answer

Apply a service control policy (SCP) to enforce CloudTrail logging.

Answer

Enable CloudTrail in each member account individually.

Question 4

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

Accepted Answer

The Suspended account cannot be used until it is reactivated.. The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Answer

The Suspended account was invited to the organization.

Answer

The Production account is the management account.

Answer

The Management account was created directly.

Question 5

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.. AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule. Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

Question 6

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Accepted Answer

Create a private hosted zone in the central networking account.. Option A is correct because a Route 53 private hosted zone must first be created in the central networking (owner) account, which becomes the zone owner and controls its records and associations. Option B is correct because AWS Resource Access Manager (RAM) is the mechanism used to share the private hosted zone with other AWS accounts in the organization so their VPCs can be associated with it. Option D is correct because after sharing, the private hosted zone must be explicitly associated with each VPC in the member accounts (via AssociateVPCWithHostedZone or the console) for DNS resolution to work in those VPCs. Option C is wrong because a public hosted zone with DNSSEC does not provide private, internal resolution across VPCs and is unrelated to this requirement. Option E is wrong because a Route 53 Resolver outbound endpoint is used to forward DNS queries from a VPC to on-premises or external resolvers, not to share private hosted zones across accounts.

Answer

Create a public hosted zone with the same name and configure DNSSEC.

Answer

Create a Route 53 Resolver outbound endpoint in each account.

Question 7

A company uses a single AWS account for development and production workloads. To improve security and cost allocation, the company decides to separate environments into multiple accounts. What is the PRIMARY benefit of using multiple accounts?

Accepted Answer

Enabling centralized security controls and consolidated billing.. Separating environments into multiple AWS accounts provides a strong security boundary (via AWS Organizations SCPs) and enables consolidated billing with cost allocation tags. This allows centralized security controls (e.g., guardrails, IAM policies) across accounts while aggregating usage for volume discounts, which is the primary benefit for improving security and cost allocation.

Answer

Reducing overall compute costs by sharing reserved instances across environments.

Answer

Simplifying backup and disaster recovery procedures.

Answer

Decreasing network latency between development and production environments.

Question 8

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Accepted Answer

Centrally enforce policies using service control policies (SCPs).. Option A is correct because AWS Organizations lets you attach service control policies (SCPs) to the root, OUs, or individual member accounts, providing centralized permission guardrails that define the maximum available permissions for IAM principals in those accounts. Option D is correct because separate accounts create strong isolation boundaries: resources, IAM roles, and billing are distinct per account, which limits blast radius for security incidents and enables per-account cost tracking and budgets. Option B is not a built-in benefit of Organizations; VPC peering connections must be created and accepted manually (or via automation), and Organizations does not auto-create them. Option C is not provided by Organizations; RDS cross-region replication (e.g., cross-region read replicas) is configured per database and is unrelated to account structure. Option E is incorrect because EC2 usage is billed per account, and Organizations does not aggregate EC2 usage across accounts to reduce instance costs (though consolidated billing can aggregate volume discounts for some services, it does not reduce EC2 instance pricing in this manner).

Answer

Automatically create VPC peering connections between accounts.

Answer

Simplify cross-region replication for Amazon RDS databases.

Answer

Reduce the total cost of EC2 instances by aggregating usage across accounts.

Question 9

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

Accepted Answer

Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.. It uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Answer

Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

Answer

Use the root user of each account to access the buckets.

Answer

Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

Question 10

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

Accepted Answer

AWS Resource Access Manager (RAM). AWS Resource Access Manager (RAM) enables you to share a transit gateway owned by a central network account with other AWS accounts in your organization. This eliminates the need to create separate transit gateway attachments or VPC peering connections, simplifying network architecture and reducing operational overhead.

Answer

AWS PrivateLink

Answer

VPC peering connection

Answer

AWS Direct Connect

Question 11

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

Accepted Answer

Apply an SCP to the development account that denies iam:CreateUser.. Service Control Policies (SCPs) are the most effective way to enforce permissions boundaries across entire accounts in AWS Organizations. An SCP applied to the development account will deny the `iam:CreateUser` action for all principals (including the root user) in that account, regardless of any IAM policies attached to users or roles. This ensures developers cannot create IAM users, even if they have full administrative access within the account.

Answer

Create an IAM group for developers with a policy that denies iam:CreateUser.

Answer

Enable AWS CloudTrail to monitor iam:CreateUser calls.

Answer

Attach an IAM policy to each developer user that denies iam:CreateUser.

Question 12

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 13

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Answer

Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

Answer

Manually enable CloudTrail in each account by logging into every account.

Answer

Create an SCP that requires CloudTrail to be enabled in each account.

Question 14

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.. Option B is correct because a centralized inspection VPC with AWS Network Firewall, combined with AWS Transit Gateway for routing, provides centralized traffic inspection and a hub-and-spoke topology that enforces common security policy across all team VPCs. Option C is correct because a dedicated network account using AWS Resource Access Manager (RAM) to share subnets lets teams consume centrally managed VPC networking while keeping network administration centralized. Option E is correct because AWS Firewall Manager applies common security group rules (and other policies) across all accounts in AWS Organizations, ensuring uniform security rules. Option A is not correct because VPC Peering is a point-to-point connection that does not scale for centralized administration or common security enforcement across many accounts. Option D is not correct because CloudFormation StackSets deploys identical VPCs per account, which duplicates network administration rather than centralizing it and does not enforce common security rules.

Answer

Allow each team to create their own VPCs and use VPC Peering to connect them.

Answer

Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

Question 15

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

Accepted Answer

Use AWS Cost Categories to group costs by tag value and set a default rule for untagged resources.. AWS Cost Categories allow you to group costs by tag values and, crucially, set a default rule for untagged resources. This ensures that all resources—tagged or not—are assigned to a cost center, providing the most accurate cost allocation across the entire organization. Other options only filter or report on tagged resources, leaving untagged costs unallocated.

Answer

Enable cost allocation tags and use AWS Cost Explorer to filter by tag.

Answer

Create AWS Budgets reports for each cost center using tag filters.

Answer

Export AWS Cost and Usage Reports to Amazon QuickSight and use tag-based filtering.