SAP-C02 Design Solutions for Organizational Complexity Practice Test 37 — 15 Questions

Question 1

A company has 200 AWS accounts in AWS Organizations. The security team wants to centrally manage IAM roles that grant cross-account access to a central security tooling account. The roles must be created consistently in every account, and any change to the role trust policy must propagate automatically. Which approach requires the LEAST ongoing effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy a stack set containing the IAM role to all accounts in the organization, and update the stack set when the trust policy changes.. CloudFormation StackSets with service-managed permissions is designed for organization-wide deployment of resources such as IAM roles. It automatically targets all accounts, including new ones, and a stack set update rolls the new trust policy to every account. This yields consistent role definitions and minimal ongoing operational effort compared with scripts or unsupported sharing mechanisms.

Answer

Create an IAM role in each account using a script that assumes a role in each account and calls CreateRole, and schedule the script to run weekly.

Answer

Use AWS Resource Access Manager to share an IAM role from the security tooling account to all other accounts.

Answer

Create a single IAM role in the management account and use AWS Single Sign-On permission sets to map users to that role in all accounts.

Question 2

A company has an AWS Organizations structure with a management account and 40 member accounts grouped into four OUs. The security team wants a single AWS account to receive all Amazon GuardDuty findings from every account and to view them in one place. They also need new accounts created under any OU to be automatically enrolled. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Designate a delegated administrator for GuardDuty in AWS Organizations and enable GuardDuty with auto-enable for all existing and new member accounts.. GuardDuty's native AWS Organizations integration is the intended mechanism for multi-account security monitoring. A delegated administrator account manages the service centrally, and auto-enable covers both existing accounts and accounts created later under any OU. This avoids building and maintaining per-account EventBridge and SNS forwarding pipelines while still delivering a consolidated findings view.

Answer

Create an organization trail in AWS CloudTrail and use CloudTrail Lake to query GuardDuty findings across all accounts.

Answer

Enable GuardDuty in each member account and create an Amazon EventBridge rule in each account that forwards findings to a central Amazon SNS topic.

Answer

Enable GuardDuty only in the management account and use AWS Resource Access Manager to share the detector with all member accounts.

Question 3

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created Amazon S3 buckets are encrypted with AWS KMS keys managed by the security account, and that any attempts to create unencrypted buckets are denied. The company also wants to ensure that existing buckets are remediated. Which two actions should the security team take to meet these requirements? (Choose two.)

Accepted Answer

Attach a service control policy to the root of the organization that denies s3:CreateBucket unless the request includes the s3:x-amz-server-side-encryption condition key with value aws:kms and the s3:x-amz-server-side-encryption-aws-kms-key-id condition key with the security account's KMS key ARN.. The SCP with conditions on s3:x-amz-server-side-encryption and s3:x-amz-server-side-encryption-aws-kms-key-id ensures that new buckets are created with the correct encryption and key. AWS Config conformance packs with automatic remediation detect and fix existing unencrypted buckets, providing ongoing compliance. Together, these actions enforce encryption at creation and remediate existing buckets.

Answer

Use AWS CloudFormation StackSets to deploy a custom resource that scans all buckets and enables encryption, and use an SCP to deny s3:CreateBucket without encryption.

Answer

Attach a service control policy to the root of the organization that denies s3:CreateBucket unless the request includes the s3:x-amz-server-side-encryption header with value aws:kms.

Answer

Use an SCP that denies s3:PutBucketEncryption if the request does not specify a KMS key ARN from the security account, and use AWS Config to remediate existing buckets.

Question 4

A financial services company has an AWS Organizations structure with a management account and 200 member accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central audit account. They need to ensure that member accounts cannot modify or delete these roles, and that new accounts automatically receive the roles. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy IAM roles to all accounts in the organization, and enable automatic deployment to new accounts.. AWS CloudFormation StackSets with service-managed permissions is designed for centralized deployment across AWS Organizations. It automatically deploys to new accounts when configured, and the StackSet maintains control, preventing member accounts from altering the deployed IAM roles. This reduces operational overhead and ensures consistent cross-account access. Other options either do not provide automatic provisioning or lack the necessary control to prevent modifications.

Answer

Use AWS Organizations service control policies (SCPs) to deny all IAM actions in member accounts except for a specific role, and manually create that role in each account.

Answer

Implement a custom AWS Lambda function that assumes a role in each member account and creates the necessary IAM roles, triggered by an Amazon EventBridge rule for new account creation.

Answer

Create an IAM role in the management account and use AWS Resource Access Manager (RAM) to share the role with all member accounts.

Question 5

A financial services company uses AWS Organizations with 300 member accounts. The security team wants to ensure that all AWS API activity in every account is logged to a central Amazon S3 bucket owned by the management account. The logs must be immutable for 7 years and protected from deletion by any member account administrator. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Create an organization trail in the management account that applies to all accounts, configure the trail to deliver to a central S3 bucket, and enable S3 Object Lock in compliance mode with a 7-year retention period on the bucket.. An organization trail in the management account automatically applies to all current and future accounts, providing centralized logging with minimal effort. Delivering to a central S3 bucket with S3 Object Lock in compliance mode ensures that logs cannot be deleted or altered by any user, including the root user, for the specified retention period. This meets the immutability and centralization requirements with the least operational overhead.

Answer

Enable AWS Config in all accounts with a conformance pack that checks for CloudTrail logging, and configure an AWS Lambda function to copy trail logs to a central S3 bucket with a lifecycle policy.

Answer

Create an individual trail in each member account that delivers to a central S3 bucket, and use a bucket policy that denies s3:DeleteObject to all principals except the management account.

Answer

Use AWS CloudTrail Lake in the management account to ingest events from all member accounts, and configure a 7-year retention period on the event data store.

Question 6

A company has a multi-account AWS environment with a central shared services VPC and multiple workload VPCs connected via AWS Transit Gateway. The security team wants to inspect all traffic between workload VPCs using a centralized firewall appliance in the shared services VPC. They need to ensure that traffic is inspected without modifying the workload VPC route tables. What should they do?

Accepted Answer

Configure AWS Transit Gateway route tables to send all inter-VPC traffic to the shared services VPC, and enable appliance mode on the Transit Gateway attachment for the shared services VPC.. To inspect traffic between workload VPCs without modifying their route tables, you can use AWS Transit Gateway route tables to direct traffic to a central shared services VPC. Enabling appliance mode on the Transit Gateway attachment for the shared services VPC ensures that flow symmetry is maintained for stateful inspection. This solution is scalable and does not require changes to workload VPC route tables.

Answer

Create a VPC peering connection between each workload VPC and the shared services VPC, and update the route tables in each workload VPC to point to the shared services VPC for inter-VPC traffic.

Answer

Use AWS PrivateLink to create endpoint services in the shared services VPC for each workload VPC, and configure the workload VPCs to use these endpoints for inter-VPC communication.

Answer

Configure AWS Transit Gateway route tables to send all inter-VPC traffic to the shared services VPC, and disable appliance mode on the Transit Gateway attachment for the shared services VPC.

Question 7

A financial services company uses AWS Organizations with 60 accounts. The security team has enabled AWS CloudTrail organization trails in the management account and wants to prevent any member account administrator from disabling CloudTrail logging in their own account. Which solution will meet this requirement with the LEAST operational overhead?

Accepted Answer

Create a service control policy in AWS Organizations that denies the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions for all member accounts.. A service control policy in AWS Organizations denies the CloudTrail actions that stop, delete, or modify a trail, so member account administrators cannot disable logging even if their IAM policies allow those actions. Because SCPs apply at the organization level to all accounts, this is preventive and requires no per-account resources, satisfying both the security and least-overhead requirements.

Answer

Create an AWS CloudFormation StackSet that deploys a CloudTrail trail in every account and configure drift detection to alert when the trail is modified.

Answer

Configure an IAM permissions boundary on every IAM role in each member account that excludes the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Use AWS Config with a managed rule that detects when a CloudTrail trail is not logging, and trigger an AWS Lambda function to restart logging when the rule is noncompliant.

Question 8

A financial services company uses AWS Organizations with a central networking account. Workload accounts need to reach an on-premises data center over AWS Site-to-Site VPN, and the network team wants to enforce that all inter-VPC traffic flows through a central inspection VPC. Which combination of components should the network team deploy to route traffic through the inspection VPC while keeping the architecture scalable?

Accepted Answer

Use AWS Transit Gateway with a central transit gateway in the networking account, attach the inspection VPC and workload VPCs to it, and use a separate route table per segment with the inspection VPC as the next hop.. A single central AWS Transit Gateway in the networking account, with workload VPC attachments and segment-specific route tables pointing to the inspection VPC, delivers scalable hub-and-spoke routing and centralized inspection. Attaching the Site-to-Site VPN to the same transit gateway keeps on-premises traffic in the same controlled path and avoids per-account VPN or peering sprawl.

Answer

Create a VPC peering mesh between all workload VPCs and the inspection VPC, and attach a virtual private gateway to each workload VPC.

Answer

Use AWS PrivateLink endpoints in each workload VPC to reach the inspection VPC, and route on-premises traffic through the endpoints.

Answer

Create a transit gateway in each workload account and peer the transit gateways together, then attach the VPN to one of them.

Question 9

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. The roles must be automatically created in all existing and future accounts, and any changes to the roles must be applied consistently. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy a stack that creates the IAM roles to all accounts in the organization.. AWS CloudFormation StackSets with service-managed permissions integrates with AWS Organizations to automatically deploy stacks to all accounts, including new ones. This enables centralized creation and updates of IAM roles across the organization without manual intervention. It provides consistency and reduces administrative effort, making it the ideal solution for this scenario.

Answer

Use AWS Organizations service control policies (SCPs) to enforce the creation of IAM roles with specific permissions in all accounts.

Answer

Create an IAM role in the management account and use AWS Resource Access Manager (RAM) to share the role with all member accounts.

Answer

Develop a script using the AWS CLI that iterates over all accounts and creates the IAM roles, and schedule it to run regularly to catch new accounts.

Question 10

A company has a multi-account AWS environment with a central network account that hosts a shared AWS Transit Gateway. The company wants to implement a hub-and-spoke network topology where all inter-VPC traffic between workload VPCs must be inspected by a central security VPC before reaching its destination. The security VPC contains an AWS Network Firewall. The company needs to ensure that traffic between any two workload VPCs is routed through the security VPC. Which configuration should a solutions architect implement?

Accepted Answer

Create two Transit Gateway route tables: one for workload VPCs and one for the security VPC. Associate each workload VPC attachment with the workload route table and propagate the security VPC attachment into it. Associate the security VPC attachment with the security route table and propagate all workload VPC attachments into it. Configure the workload route table to have a default route to the security VPC attachment.. To force all inter-VPC traffic through a central security VPC, you must prevent direct routing between workload VPCs on the Transit Gateway. Using separate route tables for workload and security attachments, with the workload route table having only a default route to the security VPC, ensures that all traffic from a workload VPC goes to the security VPC first. The security VPC route table then routes to the destination workload VPC.

Answer

Create a single Transit Gateway route table, associate all workload VPC attachments and the security VPC attachment with it, and propagate all attachments. Configure the security VPC attachment as the default route for all traffic.

Answer

Use AWS Resource Access Manager to share the Transit Gateway with all workload accounts. Configure each workload VPC to have a route to the security VPC's CIDR through a peering connection, and use the Transit Gateway for all other traffic.

Answer

Create a separate Transit Gateway route table for each workload VPC, associate the VPC attachment with its own route table, and propagate all other workload VPC attachments into that route table. Configure the security VPC attachment to be the next hop for all traffic.

Question 11

A company has 200 AWS accounts in AWS Organizations. The security team wants to centrally manage IAM roles that grant cross-account access to a central security tooling account. The roles must be created consistently in every account, and any change to the role trust policy must propagate automatically. Which approach requires the LEAST ongoing effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a transit gateway in the networking account, attach the Direct Connect gateway and all workload VPCs to it, and share the transit gateway using AWS Resource Access Manager.. A transit gateway in the networking account acts as a regional hub that connects the Direct Connect gateway and all workload VPCs. AWS Resource Access Manager shares the transit gateway with other accounts in the organization, so workload accounts attach their VPCs without creating peering meshes or per-account VPNs. This scales cleanly and reduces cost and operational overhead.

Answer

Deploy an AWS Site-to-Site VPN over the Direct Connect connection in each workload account and configure BGP to advertise the on-premises routes.

Answer

Create a VPC peering connection between the shared services VPC and each workload VPC, and propagate the Direct Connect routes through a static route in each workload VPC route table.

Answer

Use AWS PrivateLink to create interface VPC endpoints in each workload VPC that point to the on-premises services in the networking account.

Question 12

A company is adopting AWS Organizations and wants a baseline set of IAM roles, a standard VPC, and a security agent deployed automatically into every new account the moment it is created. The operations team does not want to run scripts manually after each account creation. Which AWS service should they use to meet this requirement?

Accepted Answer

AWS CloudFormation StackSets with automatic deployment enabled for the organization.. AWS CloudFormation StackSets is designed for multi-account, multi-Region provisioning from a central administrator account. Enabling automatic deployment ties stack deployment to organization membership, so each newly created account automatically receives the baseline IAM roles, VPC, and security agent. This removes the need for manual or scripted post-creation steps.

Answer

AWS Control Tower Account Factory for Terraform pipelines triggered per account.

Answer

AWS Service Catalog portfolios shared with each organizational unit.

Answer

AWS Config conformance packs applied at the organization level.

Question 13

A company has a multi-account AWS environment managed with AWS Organizations. The finance team wants to consolidate billing and receive a single bill for all accounts, while still allowing each account to have its own service usage and cost allocation tags. The company also wants to apply volume discounts across accounts. Which AWS Organizations feature should the solutions architect enable?

Accepted Answer

Enable consolidated billing for the organization so that all accounts are billed through the management account and share volume pricing benefits.. Consolidated billing in AWS Organizations aggregates all member account charges into one bill paid by the management account. It also shares volume pricing, Reserved Instance, and Savings Plans benefits across accounts. This satisfies the requirements for a single bill, per-account usage visibility, and cross-account discounts with minimal effort.

Answer

Create a separate AWS account for each business unit and use AWS Cost Explorer to manually combine the bills each month.

Answer

Enable AWS Budgets in each account and configure budget alerts to be sent to the finance team for a unified view.

Answer

Use AWS Cost and Usage Reports delivered to a central S3 bucket to generate a single invoice for all accounts.

Question 14

A company has an AWS Organizations environment with a management account, a central log archive account, and many workload accounts. The security team must prevent workload accounts from disabling AWS CloudTrail, deleting the central log bucket, or leaving the organization, while still allowing account administrators to manage their own resources. (Choose two.)

Accepted Answer

Create an S3 bucket policy on the central log bucket that denies s3:DeleteBucket and s3:DeleteObject to all principals except a tightly scoped log archive role.. Preventive guardrails require controls that block actions rather than merely detect them. Service control policies applied to the workload OUs deny trail modification and organization departure for all principals in those accounts, while an S3 bucket policy protects the central log bucket from deletion. Together they enforce the security team's requirements without removing account administrators' ability to manage other resources.

Answer

Enable AWS Config in every workload account and create a managed rule that flags noncompliant trails.

Answer

Enable Amazon GuardDuty in the management account to alert on attempts to disable logging.

Answer

Use IAM permissions boundaries on all roles in workload accounts to remove the ability to modify CloudTrail.

Question 15

A company has an AWS Organizations structure with a management account and 200 member accounts. The security team wants to prevent any member account from disabling AWS CloudTrail or deleting the organization trail. They also want to ensure that only the management account can create new trails. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:CreateTrail in all member accounts, while allowing these actions in the management account.. Service control policies in AWS Organizations provide centralized, preventive control over member accounts, including the root user, and automatically apply to new accounts. Denying StopLogging and DeleteTrail protects the organization trail, while denying CreateTrail ensures trail creation is limited to the management account, meeting the requirements with minimal operational effort.

Answer

Use AWS CloudFormation StackSets to deploy a trail in each member account and set the trail to use an S3 bucket in the management account.

Answer

Create an IAM policy in each member account that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, and attach it to all IAM roles.

Answer

Enable AWS Config in all member accounts with a managed rule that checks for CloudTrail logging and automatically remediates with a Lambda function.