SAP-C02 Design Solutions for Organizational Complexity Practice Test 38 — 15 Questions

Question 1

A financial services company has an AWS Organizations structure with a management account, a dedicated network account, and 40 workload accounts. Each workload account has its own VPC, and all VPCs must be able to reach a shared services VPC in the network account. The security team requires that all inter-VPC traffic be inspected by a central firewall appliance before reaching the shared services. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach all workload VPCs to a central AWS Transit Gateway in the network account, use a separate route table for the shared services VPC, and associate a firewall appliance VPC with a dedicated inspection route table.. A central AWS Transit Gateway with separate route tables allows all workload VPCs to route traffic through a firewall VPC in the network account before reaching shared services. This hub-and-spoke inspection model is scalable, requires minimal per-account configuration, and meets the security requirement for central inspection. Other options either lack transitivity, do not enforce inspection, or are not designed for inter-VPC routing at scale.

Answer

Use AWS PrivateLink to expose the shared services as endpoint services, and have each workload VPC create an interface VPC endpoint to access them.

Answer

Deploy a VPN connection from each workload VPC to the shared services VPC using AWS Site-to-Site VPN, and route traffic through the VPN tunnels.

Answer

Create a VPC peering connection between each workload VPC and the shared services VPC, and route traffic through the shared services VPC where a firewall appliance is deployed.

Question 2

A company has 200 AWS accounts in AWS Organizations. The compliance team needs to prove that all Amazon S3 buckets across every account have server-side encryption enabled and block public access, and they want a single dashboard showing compliance status. Which solution should they implement?

Accepted Answer

Enable AWS Config in each account with an aggregator in the compliance account and deploy managed rules for S3 encryption and public access using AWS CloudFormation StackSets.. AWS Config aggregators consolidate configuration and compliance data from all accounts and Regions into an administrator account, and managed rules can evaluate S3 encryption and public access settings. Using CloudFormation StackSets to deploy the rules ensures uniform coverage across 200 accounts, and the aggregator supplies the single compliance dashboard the team needs.

Answer

Use Amazon Macie in the compliance account to inventory all S3 buckets across the organization and report encryption status.

Answer

Create an AWS Lambda function in each account that calls the S3 API and writes results to a central Amazon DynamoDB table.

Answer

Enable AWS Trusted Advisor in the management account and review the S3 bucket permissions checks for all accounts.

Question 3

A company has an AWS Organizations setup with a management account and several member accounts. The security team wants to prevent member accounts from disabling AWS CloudTrail or modifying its configuration. They also want to ensure that all CloudTrail logs are stored in a central S3 bucket in the management account. Which combination of actions should be taken?

Accepted Answer

Apply a service control policy (SCP) to all member accounts that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail. Configure CloudTrail in the management account to log all accounts and deliver to a central S3 bucket.. Service control policies (SCPs) in AWS Organizations can deny CloudTrail modification actions across member accounts, providing a preventive control. An organization trail created in the management account automatically logs activity in all accounts and delivers to a central S3 bucket. This combination ensures centralized, tamper-resistant logging without per-account configuration.

Answer

Create an IAM policy in each member account that denies CloudTrail modification actions to all users, and enable CloudTrail in each account with a trail that delivers to a central S3 bucket.

Answer

Use AWS Config rules in each member account to detect and remediate any changes to CloudTrail configuration. Store logs in a central S3 bucket by configuring each account's trail to deliver to the bucket.

Answer

Enable AWS CloudTrail in the management account with organization trail, and use AWS Organizations to apply a tag policy that prevents member accounts from modifying CloudTrail.

Question 4

A company has a single AWS account with multiple VPCs. They want to connect all VPCs to a central VPC for shared services, such as Active Directory and DNS, without using a complex mesh of VPC peering connections. They also want to minimize costs. Which solution should they use?

Accepted Answer

Use AWS Transit Gateway to connect all VPCs and the shared services VPC.. AWS Transit Gateway provides a central hub to connect multiple VPCs and shared services. It simplifies network architecture, reduces management overhead, and is cost-effective compared to a full mesh of VPC peering connections. It allows all VPCs to access the shared services VPC without complex peering arrangements.

Answer

Use AWS PrivateLink to connect each VPC to the shared services VPC.

Answer

Create a full mesh of VPC peering connections between all VPCs.

Answer

Create a VPN connection between each VPC and the shared services VPC.

Question 5

A company is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets in member accounts are encrypted with AWS KMS customer managed keys, and that the keys are created and managed centrally in a security account. Which solution should a solutions architect recommend?

Accepted Answer

Create KMS keys in the security account and grant member accounts permission to use them via key policies and IAM policies. Use an S3 bucket policy in each member account to enforce encryption with the central key.. Creating KMS keys in a central security account and sharing them with member accounts via key policies and IAM policies keeps key management centralized. Enforcing encryption with those keys through S3 bucket policies in each member account ensures all buckets use the approved keys, meeting both the central management and encryption requirements.

Answer

Create KMS keys in each member account and use AWS CloudFormation StackSets to deploy bucket policies that enforce their use.

Answer

Use AWS Secrets Manager to store KMS key material centrally and grant member accounts access to the secret.

Answer

Enable default encryption on all S3 buckets using SSE-S3 and use AWS Config to monitor compliance.

Question 6

A healthcare company has a multi-account AWS environment with a central audit account. Compliance requires that all access to Amazon S3 buckets containing protected health information be logged and that logs be immutable for seven years. The company wants to centralize log storage and prevent any account, including the management account, from deleting or modifying the logs. Which combination of steps should a solutions architect take?

Accepted Answer

Enable AWS CloudTrail data events for S3 in all accounts, deliver logs to a central S3 bucket in the audit account, and enable S3 Object Lock in compliance mode on that bucket with a seven-year retention period.. CloudTrail data events capture object-level S3 operations, and delivering them to a central audit account bucket centralizes storage. S3 Object Lock in compliance mode enforces a write-once-read-many model that no principal, including the management account root user, can override during the retention period, which meets the seven-year immutability requirement.

Answer

Use AWS Config to record S3 bucket changes, store the configuration history in the audit account, and enable S3 Object Lock in governance mode for seven years.

Answer

Enable AWS CloudTrail management events only, deliver logs to a central S3 bucket, and configure a bucket policy that denies s3:DeleteObject for all principals.

Answer

Enable S3 server access logging on each bucket, deliver the logs to a central bucket, and use an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. They must avoid IP address conflicts. What is the MOST appropriate solution?

Accepted Answer

Re-create the VPC with a non-overlapping CIDR block, such as 192.168.0.0/16, and then establish the Site-to-Site VPN.. IP address conflicts between a VPC and on-premises networks can cause routing failures and unpredictable behavior. The most appropriate solution is to use non-overlapping CIDR blocks. Re-creating the VPC with a CIDR that does not overlap with the on-premises 10.0.0.0/8 network ensures clean routing and avoids the need for complex NAT or translation. While migration may be required, it is the most reliable long-term fix.

Answer

Use AWS Transit Gateway with a Site-to-Site VPN attachment and enable route propagation.

Answer

Configure the Site-to-Site VPN with static routes and use AWS PrivateLink to access on-premises services.

Answer

Use AWS Site-to-Site VPN with a virtual private gateway and implement NAT on the on-premises side to translate the VPC CIDR to a non-overlapping range.

Question 8

A company has an AWS Organizations setup with a management account and several member accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. They need to ensure that when a new member account is added, the required IAM role is automatically created with a trust policy that allows the security account to assume it. The solution must minimize manual steps and work across all current and future accounts. Which approach should be used?

Accepted Answer

Use AWS CloudFormation StackSets with service-managed permissions to deploy a stack set that creates the IAM role in all accounts in the organization, and configure automatic deployment to new accounts.. CloudFormation StackSets with service-managed permissions are designed to deploy resources across an organization. By enabling automatic deployment, new accounts automatically receive the stack set, creating the required IAM role. This approach is scalable, requires no custom code, and ensures consistent configuration across all accounts.

Answer

Use AWS Resource Access Manager to share an IAM role from the security account with all member accounts.

Answer

Implement a solution using AWS Service Catalog to share a portfolio containing the IAM role with all accounts, and require users to provision it manually.

Answer

Create an IAM role in each member account manually and use an AWS Lambda function triggered by AWS Organizations events to create the role in new accounts.

Question 9

A company has 30 AWS accounts in AWS Organizations. The finance team wants to receive a single consolidated bill for all accounts and apply volume discounts across the organization. Which action should a solutions architect take?

Accepted Answer

Enable consolidated billing by inviting all accounts to join the organization, and designate one account as the management account.. Consolidated billing in AWS Organizations makes the management account responsible for paying all charges and produces one bill for the organization. It also combines usage across accounts for volume pricing and allows sharing of Reserved Instances and Savings Plans, which is exactly what the finance team needs.

Answer

Create an AWS Cost and Usage Report in each account and use AWS Cost Explorer to merge the reports into a single view.

Answer

Use AWS Resource Access Manager to share a billing resource across all accounts and enable cost allocation tags.

Answer

Configure AWS Budgets in the management account to aggregate spend from all member accounts and send a single invoice.

Question 10

A company is using AWS Organizations with all features enabled. They want to apply a service control policy (SCP) that denies the ability to delete AWS KMS keys across all member accounts, but they need to allow a specific break-glass role in the management account to delete keys in case of emergency. Which statement is true regarding SCP enforcement in this scenario?

Accepted Answer

SCPs apply to all principals in member accounts, including the root user, but do not apply to the management account, so the break-glass role in the management account is unaffected.. SCPs are guardrails that apply to all principals in member accounts, including the root user, but they are not evaluated for the management account. Therefore, a role in the management account can perform actions denied by an SCP attached to member accounts. This allows the break-glass role to delete KMS keys without needing an exemption in the SCP.

Answer

SCPs apply to all accounts in the organization, including the management account, so the break-glass role must be explicitly exempted in the SCP.

Answer

SCPs apply only to IAM users, not to IAM roles, so the break-glass role is unaffected regardless of which account it is in.

Answer

SCPs apply to member accounts but can be overridden by an IAM policy in the member account that allows kms:ScheduleKeyDeletion.

Question 11

A financial services company uses AWS Organizations with all features enabled. A security account runs AWS CloudFormation StackSets with service-managed permissions to deploy guardrail resources into every account. Compliance requires that no member account administrator can disable AWS CloudTrail or delete the organization trail, even in accounts where they hold full administrative rights, and that new accounts automatically receive the guardrail. Which combination should the solutions architect recommend?

Accepted Answer

Deploy an organization trail from the management account and attach a service control policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to all member accounts except the management account.. An organization trail owned by the management account extends logging to all accounts and cannot be modified or deleted by member accounts. Pairing it with a service control policy that denies the stop and delete actions on CloudTrail removes those capabilities from member-account administrators, because SCPs bound the permissions available to every principal in the account. Accounts created later automatically fall under the same trail and policy.

Answer

Create a trail in each member account with AWS CloudFormation StackSets and enable log file validation so tampering with delivered logs is detectable.

Answer

Enable AWS CloudTrail Lake in the security account and configure an event data store that ingests management events from all accounts through AWS Organizations.

Answer

Deploy a CloudFormation StackSet that creates a trail and an IAM policy denying cloudtrail:StopLogging, and attach the policy to every IAM role in each account.

Question 12

A company has an AWS Organizations setup with a management account and several member accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account for incident response. They need to ensure that the roles can be assumed only by specific IAM principals in the security account and that the permissions are consistent across all member accounts. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a standardized IAM role in each member account with a trust policy that allows assumption by the security account's incident response role, and manage updates centrally.. CloudFormation StackSets provide a centralized, scalable way to deploy and update IAM roles across multiple accounts with consistent trust policies. This ensures only the specified security account principal can assume the roles, and updates are managed from a single place, minimizing operational overhead.

Answer

Use AWS IAM Identity Center (successor to AWS Single Sign-On) to create a permission set that grants access to the security account, and assign it to all member accounts.

Answer

Implement a custom AWS Lambda function that uses the AWS SDK to create the IAM role in each member account upon a scheduled trigger.

Answer

Create an IAM role in each member account manually and use AWS Organizations SCPs to enforce that only the security account can assume it.

Question 13

A multinational company has a multi-account AWS environment with a central network account. They use AWS Transit Gateway to connect all VPCs. The company wants to implement centralized inspection of all traffic between VPCs using a third-party firewall appliance running on EC2 instances in a dedicated inspection VPC. Traffic must be inspected without modifying workload VPC route tables when new VPCs are added. What should the solutions architect recommend?

Accepted Answer

Use AWS Transit Gateway with a separate route table for the inspection VPC, and configure the firewall instances as appliances in the inspection VPC. Use Transit Gateway route table associations and propagations to direct traffic through the inspection VPC.. Transit Gateway route tables allow centralized traffic steering. By associating workload VPC attachments with a route table that routes to the inspection VPC, and the inspection VPC attachment with a route table that routes back, traffic is forced through the firewall. New VPCs only need to be associated with the correct route table, avoiding workload VPC route table changes.

Answer

Deploy the firewall instances in the central network account and use AWS Resource Access Manager to share them with all workload accounts, then update each workload VPC's route tables to point to the firewall ENIs.

Answer

Use AWS PrivateLink to connect each workload VPC to the inspection VPC, and configure endpoint policies to redirect traffic.

Answer

Create a VPC peering connection between each workload VPC and the inspection VPC, and update each workload VPC's route tables to point to the inspection VPC for inter-VPC traffic.

Question 14

A company has a multi-account AWS environment with a central security account. The security team needs to audit all API activity across all accounts and retain the logs for 7 years in a tamper-evident manner. They also need to ensure that no account administrator can disable or modify the logging configuration. Which solution meets these requirements?

Accepted Answer

Create an organization trail in AWS CloudTrail that applies to all accounts, deliver logs to a central S3 bucket in the security account, enable S3 Object Lock in compliance mode, and use SCPs to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail.. An organization trail in CloudTrail centralizes logging across all accounts, delivering to a central S3 bucket. S3 Object Lock in compliance mode ensures logs cannot be deleted or altered for the retention period, meeting tamper-evident requirements. SCPs prevent member accounts from stopping or deleting the trail. This solution provides the necessary audit coverage, retention, and protection against administrative tampering.

Answer

Use AWS CloudTrail Lake to aggregate all events, set a retention period of 7 years, and use AWS KMS to encrypt the event data store.

Answer

Enable AWS Config in all accounts to record API activity, deliver snapshots to a central S3 bucket, and use AWS Config rules to monitor changes.

Answer

Create individual trails in each account, deliver logs to a central S3 bucket, enable versioning and MFA delete on the bucket, and use IAM policies to restrict access to the bucket.

Question 15

A company has a multi-account AWS environment with AWS Organizations. They use AWS IAM Identity Center (successor to AWS Single Sign-On) for workforce access. The security team wants to ensure that all federated users from the corporate identity provider (IdP) are automatically assigned to the appropriate permission sets based on their group membership in the IdP. The company uses SAML 2.0 federation with IAM Identity Center. Which configuration should the solutions architect implement to achieve automatic group-based permission set assignments?

Accepted Answer

Configure SCIM synchronization between the IdP and IAM Identity Center, and map IdP groups to IAM Identity Center groups. Then assign permission sets to those groups.. SCIM synchronization automatically provisions users and groups from the corporate IdP into IAM Identity Center. By mapping IdP groups to IAM Identity Center groups and assigning permission sets to those groups, users receive the correct permissions based on their group membership without manual intervention.

Answer

Configure IAM Identity Center to use an external identity provider only for authentication, and use AWS Lambda functions triggered by IdP events to call the IAM Identity Center API to assign permission sets.

Answer

Use SAML attribute mappings in IAM Identity Center to pass group names as session tags, and create IAM roles with trust policies that conditionally allow access based on those tags.

Answer

Manually create IAM Identity Center groups that match the IdP group names, and assign permission sets to those groups. Update memberships manually when IdP groups change.