SAP-C02 Design Solutions for Organizational Complexity Practice Test 34 — 15 Questions

Question 1

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure CloudTrail in each account to deliver logs to a single S3 bucket in the security account.. CloudTrail can be configured in each account to deliver log files to a centralized S3 bucket in the security account. This approach aggregates all IAM user activities into a single location without requiring additional streaming infrastructure, and it scales automatically as new accounts are added. The central security team can then use Amazon Athena or AWS Lake Formation to query the logs across all accounts efficiently.

Answer

Enable CloudTrail Insights in each account and review separately.

Answer

Use AWS Config aggregator to collect IAM user activity.

Answer

Set up Amazon Kinesis Data Streams in each account and stream to a central Kinesis Data Firehose.

Question 2

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.. AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Answer

Use AWS Single Sign-On (SSO) to grant the audit team access to each account.

Answer

Create an IAM user in the audit account and allow that user to assume a role in each account.

Answer

Manually create an IAM role in each account and attach a read-only policy.

Question 3

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies any instance type not in the allowed list.. The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.

Answer

The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.

Answer

The instance launch is denied, but only if the account's IAM policy also denies it.

Answer

The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.

Question 4

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

Accepted Answer

Enable Security Hub in the central account and invite member accounts to enable Security Hub.. AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Answer

Set up Amazon EventBridge to forward findings from each account to the central account.

Answer

Use Amazon CloudWatch cross-account dashboards to view findings.

Answer

Enable AWS Config aggregator in the central account.

Question 5

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

Accepted Answer

The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.. The bucket policy explicitly grants access to the member account's root user ARN (e.g., `arn:aws:iam::123456789012:root`). When a developer assumes an IAM role in the member account, the resulting session has a different ARN (e.g., `arn:aws:sts::123456789012:assumed-role/DevRole/session`). Because the bucket policy's Principal is restricted to the root user ARN, the role session is not recognized as a matching principal, and access is denied. This is a common misconfiguration when mixing root user grants with assumed-role access.

Answer

The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.

Answer

The bucket policy requires an explicit Deny for all principals except the root user.

Answer

A service control policy (SCP) is denying access to the S3 bucket.

Question 6

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

Accepted Answer

AWS Control Tower and Service Control Policies (SCPs).. AWS Control Tower provides a managed service to automate the creation of new AWS accounts through Account Factory, while Service Control Policies (SCPs) enforce baseline security guardrails across all accounts in the organization. This combination ensures that every new account is provisioned with consistent security policies without manual intervention.

Answer

AWS Service Catalog and AWS Config.

Answer

AWS Organizations API and CloudTrail.

Answer

AWS CloudFormation StackSets and IAM.

Question 7

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Accepted Answer

Attach the VPCs in member accounts to the transit gateway.. Option A is correct because each VPC that must send traffic through the transit gateway needs a transit gateway attachment in its own account (or a shared attachment), which is created by attaching the VPC to the transit gateway. Option B is correct because the VPC route tables must contain routes that direct inter-VPC traffic (for example, the remote VPC CIDR) to the transit gateway attachment; without these routes, traffic will not be forwarded to the transit gateway. Option E is correct because AWS Resource Access Manager (RAM) is used to share the transit gateway from the centralized networking account with the member accounts, allowing those accounts to create attachments to the shared transit gateway. Option C is incorrect because VPC endpoints are for private connectivity to AWS services or VPC endpoint services, not for routing traffic through a transit gateway. Option D is incorrect because VPC peering creates direct VPC-to-VPC connectivity that bypasses the transit gateway, which contradicts the requirement that all inter-VPC traffic flow through the transit gateway.

Answer

Create VPC endpoints for the transit gateway in each VPC.

Answer

Create VPC peering connections between each VPC and the networking VPC.

Question 8

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny creation of IAM roles except through AWS CloudFormation, and use a centrally managed CloudFormation template via StackSets.. AWS Organizations SCPs can be used to deny the creation of IAM roles except through AWS CloudFormation, ensuring that roles are only created via a centrally managed template. By combining this with AWS CloudFormation StackSets, the security team can deploy IAM roles from a single template across all member accounts, enforcing the principle of least privilege and providing full auditability through CloudFormation stack events and AWS CloudTrail.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles from a central template in each account.

Answer

Configure AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them.

Answer

Create a Lambda function that monitors CloudTrail events for role creation and sends alerts.

Question 9

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.. AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Answer

Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.

Answer

Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.

Answer

Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.

Question 10

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

Accepted Answer

Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.. Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Answer

Create a separate AWS account for prod and use an IAM policy on the account.

Answer

Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.

Answer

Use AWS Config to detect non-approved instance types and terminate them.

Question 11

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

Accepted Answer

Create an AWS Service Catalog product that uses AWS Organizations APIs to create a new account, applies a baseline CloudFormation template, and moves the account to the correct OU.. It uses AWS Service Catalog to provide a self-service portal for the development team, while the central IT team retains governance by embedding AWS Organizations API calls to create accounts, apply a baseline CloudFormation template for security and compliance, and automatically move the account to the correct Organizational Unit (OU). This approach enforces guardrails without granting direct management account access.

Answer

Use AWS CloudFormation StackSets to create accounts in bulk.

Answer

Use the AWS Organizations console to manually create accounts and assign them to the appropriate OU.

Answer

Give the development team the credentials to the management account and let them create accounts directly.

Question 12

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Accepted Answer

AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.. Option B is correct because AWS Organizations lets the management account create an organization trail in AWS CloudTrail that automatically applies to all member accounts, providing centralized logging of API activity across the organization. Option D is correct because consolidated billing aggregates usage from all member accounts into a single bill paid by the management account, and this combined usage can qualify for volume pricing discounts on services like S3 and data transfer. Option A is incorrect because SCPs do not apply to the management account; they only affect member accounts (and the management account is exempt to prevent lockout). Option C is incorrect because AWS Organizations uses consolidated billing, so member accounts do not each need their own payment method—the management account pays the single bill. Option E is incorrect because AWS Config supports organization-wide rules and conformance packs deployed from the management account across member accounts via AWS Organizations.

Answer

Service control policies (SCPs) apply to all accounts in the organization, including the management account.

Answer

Each account in an organization must have its own payment method.

Answer

AWS Config rules cannot be applied across accounts via AWS Organizations.

Question 13

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) (B) are correct because they set permission guardrails at the organization, OU, or account level, defining the maximum permissions available to IAM principals in member accounts, which directly enforces least privilege across multiple accounts. IAM Access Analyzer (D) is correct because it analyzes resource-based policies and IAM policies to identify resources shared with external entities or unused permissions, generating findings that help teams tighten access to only what is needed. AWS KMS (A) is a key management and encryption service, not a mechanism for enforcing least-privilege access boundaries across accounts. AWS Config (C) evaluates resource configuration compliance but does not itself restrict or grant permissions. AWS CloudTrail (E) provides API activity logging and auditing, which supports detection and investigation rather than enforcement of least privilege.

Answer

AWS Key Management Service (KMS)

Answer

AWS Config

Answer

AWS CloudTrail

Question 14

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

Accepted Answer

Verify that the AWS Config aggregator in the security account has the correct authorization to assume a role in each member account.. AWS Config aggregators require cross-account authorization to collect configuration data from member accounts. Even if AWS Config is enabled in member accounts, the aggregator in the security account must have the correct IAM role permissions (via an IAM role in each member account) to assume and retrieve configuration snapshots. Without this authorization, the aggregator cannot access the member accounts' data, causing them to not appear.

Answer

Ensure that the member accounts have enabled AWS Config in the same region as the aggregator.

Answer

Check if the member accounts have exceeded the AWS Config resource limits.

Answer

Check if the AWS Config recorder in the member accounts is configured to record all resource types.

Question 15

A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.. It combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.

Answer

Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.

Answer

Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.

Answer

Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.