SAP-C02 Design Solutions for Organizational Complexity Practice Test 35 — 15 Questions

Question 1

A large enterprise is migrating to AWS and wants to implement a multi-account strategy with centralized network connectivity. The company has multiple VPCs in various accounts that need to communicate with each other and with on-premises resources. The solution must be scalable and minimize operational overhead. Which design should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an AWS Transit Gateway in a central network account and attach all VPCs from the various accounts.. AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks, enabling scalable, low-operational-overhead connectivity across multiple accounts. By placing the Transit Gateway in a central network account and using AWS Resource Access Manager to share it with other accounts, the enterprise can avoid the complexity of managing many individual connections while supporting transitive routing and centralized control.

Answer

Use AWS PrivateLink to connect VPCs via interface endpoints.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Set up a VPN connection from each VPC to the on-premises network and use routing to enable inter-VPC communication.

Question 2

A company is using AWS Organizations with multiple accounts. The central IT team wants to enforce that all EC2 instances are launched with specific tags (e.g., CostCenter and Environment). The solution should prevent any untagged instances from being created. Which approach should be taken?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.. AWS Organizations SCPs can centrally enforce tag requirements by denying the ec2:RunInstances action when required tags are not specified in the request. While IAM policies can also use condition keys like aws:RequestTag to enforce tags, managing individual IAM policies across many accounts is less efficient and harder to maintain. SCPs provide a preventive control that applies to all principals in an account, ensuring consistent enforcement without relying on detection and remediation.

Answer

Use AWS Service Catalog to provision EC2 instances only from pre-configured products that include required tags.

Answer

Use an AWS Config rule to detect untagged instances and trigger a Lambda function to terminate them.

Answer

Create an IAM policy for each account that requires tags on instance creation.

Question 3

A company wants to centralize management of IAM users and groups across multiple AWS accounts. The solution should allow users to access resources in any account without needing separate credentials. Which AWS service should be used?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and applications. It integrates with AWS Organizations to manage user and group permissions across accounts, eliminating the need for separate IAM users in each account.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Question 4

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

Accepted Answer

Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.. A Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Answer

Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

Answer

Use AWS CloudFormation templates that specify t3.micro.

Answer

Use AWS Config rules to terminate non-compliant instances.

Question 5

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that integrates with AWS Organizations to centrally manage backups across multiple accounts. It allows you to define backup policies that automatically apply to EC2 instances and other supported resources across all member accounts, ensuring compliance and centralized monitoring without requiring per-account manual configuration.

Answer

AWS CloudEndure Disaster Recovery

Answer

Amazon S3 Glacier

Answer

AWS Storage Gateway

Question 6

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

Accepted Answer

Use AWS Config rules to detect public buckets and trigger an AWS Lambda function to make them private.. AWS Config rules can continuously evaluate S3 bucket configurations against a custom or managed rule (e.g., 's3-bucket-public-read-prohibited'). When a bucket is detected as publicly accessible, the rule can invoke an AWS Lambda function via an Amazon CloudWatch Events event to automatically apply a bucket policy that removes public access, achieving automated remediation.

Answer

Use Amazon Inspector to scan for public buckets.

Answer

Use an SCP to deny making buckets public.

Answer

Use AWS CloudTrail to send alerts when a bucket becomes public.

Question 7

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

Accepted Answer

Use CloudWatch cross-account dashboards with a monitoring account.. CloudWatch cross-account dashboards allow you to create a single dashboard in a central monitoring account that displays metrics from multiple source accounts. This is the native AWS solution for centralized observability, requiring no additional data movement or custom code. The monitoring account uses the CloudWatch cross-account functionality to query metrics across accounts via IAM roles and the CloudWatch API.

Answer

Use AWS Config aggregator to view resources.

Answer

Use Amazon QuickSight with data sources from each account.

Answer

Use AWS CloudFormation StackSets to deploy dashboards in each account.

Question 8

A company has a multi-account AWS environment with a central security account. They want to enable Amazon GuardDuty in all accounts and centrally view findings. The security team has already enabled GuardDuty in the security account and invited all member accounts. However, the security account is not receiving findings from all member accounts. Upon investigation, some member accounts show that GuardDuty is not enabled, and some show that they have not accepted the invitation. The team needs a scalable solution to enable GuardDuty across all accounts and ensure findings are sent to the security account. What should the team do?

Accepted Answer

Use the GuardDuty delegated administrator feature with AWS Organizations to automatically enable GuardDuty in all accounts and centralize findings.. The GuardDuty delegated administrator feature integrated with AWS Organizations allows the security account to be designated as the GuardDuty administrator, which can then automatically enable GuardDuty for all existing and future member accounts in the organization. This eliminates the need for manual invitations and acceptances, ensuring that findings are centrally aggregated in the security account without requiring per-account configuration.

Answer

Use AWS Config rules to detect accounts without GuardDuty and send alerts.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty resources in each account.

Answer

Use AWS Control Tower to enable GuardDuty in all accounts via a custom blueprint.

Question 9

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

Accepted Answer

Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.. AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.

Answer

Deploy AWS CloudFormation StackSets to each account with security templates.

Answer

Create a shared services account and use IAM cross-account roles for each business unit.

Answer

Migrate all workloads to a single AWS account and use IAM roles for each business unit.

Question 10

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

Accepted Answer

Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.. AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.

Answer

Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.

Answer

Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.

Question 11

A company uses AWS Organizations and has a requirement that all Amazon S3 buckets must have versioning enabled. The company wants to automatically enable versioning on any bucket that is created without it. Which solution should be implemented?

Accepted Answer

Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.. AWS Config can detect S3 buckets without versioning using the managed rule `s3-bucket-versioning-enabled`, and then automatically remediate the noncompliant resource by invoking an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven solution that meets the requirement without manual intervention or blocking bucket creation.

Answer

Use an SCP to deny s3:CreateBucket unless versioning is enabled.

Answer

Use AWS Config to detect buckets without versioning and send an SNS notification.

Answer

Use AWS CloudFormation StackSets to deploy a bucket with versioning enabled in each account.

Question 12

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

Accepted Answer

Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.. AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.

Answer

Use an SCP to require that all IAM roles trust the corporate IdP.

Answer

Create IAM roles in each account with a trust policy that allows the corporate IdP.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.

Question 13

A company has a complex AWS environment with multiple accounts and VPCs. The company wants to ensure that all outbound traffic from VPCs goes through a centralized inspection VPC for security monitoring. The company uses AWS Transit Gateway. Which solution should be implemented?

Accepted Answer

Create a Transit Gateway with route tables. Attach the inspection VPC as a central hub. Configure the route tables of the transit gateway to point the default route (0.0.0.0/0) to the inspection VPC attachment. Then attach all other VPCs and configure their route tables to send traffic to the Transit Gateway.. It uses AWS Transit Gateway with centralized route tables to force all outbound traffic from attached VPCs through the inspection VPC. By configuring the Transit Gateway route table with a default route (0.0.0.0/0) pointing to the inspection VPC attachment, all outbound traffic from other VPCs is routed to the inspection VPC for security monitoring before leaving the network. This design meets the requirement of a single, centralized inspection point without requiring VPC peering or per-VPC firewall deployments.

Answer

Deploy AWS Network Firewall in each VPC and configure routing to send outbound traffic through the firewall.

Answer

Use VPC peering to connect all VPCs to the inspection VPC and configure routes.

Answer

Use Route 53 Resolver to forward all outbound DNS queries to the inspection VPC.

Question 14

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

Accepted Answer

The SCP denies all services not explicitly allowed, and EC2 is not on the whitelist. The SCP uses a deny-all approach with a whitelist of allowed services. Since EC2 is not on that whitelist, the SCP implicitly denies all EC2 actions, overriding any IAM policy that explicitly allows ec2:RunInstances. SCPs act as a guardrail that cannot be bypassed by account-level IAM policies.

Answer

The IAM role used by the DevOps team has a trust policy that does not allow EC2 actions

Answer

The EC2 service has been disabled via AWS Config in that account

Answer

The development account is in an organizational unit (OU) with a different SCP that denies EC2

Question 15

A company uses AWS Organizations with a management account and 40 member accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a shared services account. They want to deploy the roles to all member accounts and ensure new accounts automatically receive the roles. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an AWS CloudFormation StackSet with service-managed permissions in the management account, and configure automatic deployment to all accounts in the organization.. CloudFormation StackSets with service-managed permissions is the native AWS Organizations-integrated solution for deploying a common stack to many accounts. It automatically targets existing accounts and new accounts as they join the organization, and it can be configured to deploy to specific OUs. This provides centralized management with minimal ongoing effort, unlike manual or script-based approaches.

Answer

Use AWS Systems Manager Automation to run a script in each member account that creates the required IAM roles.

Answer

Enable AWS Control Tower and use its Account Factory to provision new accounts with a custom blueprint that includes the IAM roles.

Answer

Create an IAM role in the management account and use AWS Resource Access Manager (RAM) to share it with all member accounts.