SAP-C02 Design Solutions for Organizational Complexity Practice Test 4 — 15 Questions

Question 1

A financial services company is migrating its trading platform to AWS. The platform consists of hundreds of microservices deployed in containers using Amazon ECS with Fargate launch type. Each service has its own IAM role for fine-grained permissions. The security team requires that all ECS tasks use a specific VPC (vpc-12345) and cannot run in any other VPC. During a recent audit, it was discovered that some tasks are running in a different VPC (vpc-67890). The solutions architect must implement a preventive control to ensure that ECS tasks only run in the approved VPC. The company uses AWS Organizations and has Service Control Policies (SCPs) in place. What should the solutions architect do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies ecs:RunTask and ecs:CreateService unless the networkConfiguration.awsvpcConfiguration.subnets are in the approved VPC.. Service Control Policies (SCPs) in AWS Organizations provide a preventive control that applies across all accounts in the organization. By denying ecs:RunTask and ecs:CreateService unless the subnets specified in networkConfiguration.awsvpcConfiguration belong to the approved VPC (vpc-12345), the SCP enforces the VPC constraint at the organization level, preventing any task from launching in a non-approved VPC regardless of individual IAM roles or account configurations.

Answer

Tag the approved VPC and use IAM policies to allow ECS actions only when the VPC tag matches.

Answer

Add an IAM policy to each ECS task role that denies the action if the VPC is not the approved one.

Answer

Use AWS Config rules to detect tasks running in non-approved VPCs and trigger a remediation action.

Question 2

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Accepted Answer

Step 1: Create virtual interface in AWS, Step 2: Configure on-premises router, Step 3: Establish BGP session, Step 4: Verify interface availability, Step 5: Update route tables. The correct order is: first create the virtual interface in AWS, then configure the on-premises router, establish BGP, verify availability, and finally update route tables.

Answer

Step 1: Configure on-premises router, Step 2: Create virtual interface in AWS, Step 3: Establish BGP session, Step 4: Verify interface availability, Step 5: Update route tables

Answer

Step 1: Create virtual interface in AWS, Step 2: Establish BGP session, Step 3: Configure on-premises router, Step 4: Verify interface availability, Step 5: Update route tables

Answer

Step 1: Create virtual interface in AWS, Step 2: Configure on-premises router, Step 3: Update route tables, Step 4: Establish BGP session, Step 5: Verify interface availability

Question 3

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Accepted Answer

1. Navigate to snapshots, 2. Restore, 3. Configure settings, 4. Wait for completion, 5. Update application endpoint. First navigate to snapshots, restore, configure settings, wait for completion, then update application endpoint.

Answer

1. Configure settings, 2. Restore, 3. Navigate to snapshots, 4. Wait for completion, 5. Update application endpoint

Answer

1. Navigate to snapshots, 2. Restore, 3. Update application endpoint, 4. Wait for completion, 5. Configure settings

Answer

1. Restore, 2. Navigate to snapshots, 3. Configure settings, 4. Wait for completion, 5. Update application endpoint

Question 4

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

Accepted Answer

Create an S3 bucket, then create the trail, then configure events, then enable security features, then verify delivery.. First create the S3 bucket, then create the trail, configure events, enable security features, and verify delivery.

Answer

Create the trail, then configure events, then create an S3 bucket, then enable security features, then verify delivery.

Answer

Create an S3 bucket, then create the trail, then enable security features, then configure events, then verify delivery.

Answer

Create an S3 bucket, then configure events, then create the trail, then enable security features, then verify delivery.

Question 5

Match each AWS service to its primary use case.

Accepted Answer

AWS Organizations: Centrally manage multiple AWS accounts and consolidate billing. Correct matches: AWS Organizations for account management, AWS Direct Connect for dedicated private connection, AWS VPN for encrypted internet connection, AWS Transit Gateway for hub-and-spoke network interconnection. Common confusions include swapping Direct Connect and VPN, or misattributing account management to networking services.

Answer

AWS Organizations: Dedicated private network connection from on-premises to AWS

Answer

AWS Direct Connect: Secure encrypted connection over the public internet to AWS

Question 6

Match each AWS migration service to its function.

Accepted Answer

AWS Migration Hub: Centralized tracking of migration progress. AWS Migration Hub centralizes tracking, SMS automates server replication, DMS handles database migration, and Application Discovery Service discovers on-premises assets.

Answer

AWS Migration Hub: Migrates databases to AWS with minimal downtime

Answer

AWS Server Migration Service: Discovers on-premises applications and dependencies

Question 7

Match each AWS disaster recovery strategy to its description.

Accepted Answer

Backup and Restore: Data is backed up to S3 and restored when needed.. AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Answer

Backup and Restore: A scaled-down version of the environment runs and can be scaled up quickly.

Answer

Pilot Light: Data is backed up to S3 and restored when needed.

Question 8

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.. AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.

Answer

Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.

Answer

Use AWS Systems Manager Automation to apply the baseline to new accounts.

Answer

Use AWS Config aggregators to apply the baseline controls to new accounts.

Question 9

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

Accepted Answer

Use a shared VPC with separate subnets for each team, with IAM policies to control access.. A shared VPC allows the central IT team to own and manage the networking resources (VPC, subnets, route tables, etc.) while each application team can independently manage their own EC2 instances and RDS databases within their designated subnets. IAM policies can be scoped to restrict each team to only their subnets and resources, achieving clear separation of duties without requiring multiple VPCs or complex connectivity.

Answer

Use AWS Transit Gateway to connect individual VPCs managed by each team.

Answer

Create a single VPC and use VPC peering to connect team resources.

Answer

Create a separate VPC for each application team and use VPC peering.

Question 10

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

Accepted Answer

Use AWS Organizations to register the member account as a delegated administrator for the service.. AWS Organizations allows you to designate a member account as a delegated administrator for a specific AWS service. Once registered, that account can perform administrative actions (e.g., creating resources, managing policies) across all accounts in the organization on behalf of that service, without needing individual IAM roles or permissions in each account.

Answer

Create a service-linked role in each account to allow the service to perform actions.

Answer

Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.

Answer

Create an IAM role in each account with a trust policy that allows the service to assume it.

Question 11

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

Accepted Answer

Use SAML 2.0 federation between AWS SSO and the on-premises AD.. AWS IAM Identity Center (formerly AWS SSO) can integrate with an on-premises Active Directory using SAML 2.0 federation. This involves configuring a SAML 2.0 identity provider (such as Active Directory Federation Services) to federate with IAM Identity Center. Option C is incorrect because it describes combining AWS Managed Microsoft AD and AD Connector, which is not a valid integration method. The correct approaches are either using AD Connector alone or AWS Managed Microsoft AD with a trust, not both together. Other options are not viable direct integration methods.

Answer

Use AWS IAM Identity Center with an external identity provider that supports SCIM.

Answer

Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.

Answer

Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

Question 12

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

Accepted Answer

Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.. VPC Flow Logs can be published to an S3 bucket in a different account by using a resource-based bucket policy that grants the VPC Flow Logs service principal (delivery.logs.amazonaws.com) write access. Additionally, since the logs must be encrypted at rest with a KMS key in the logging account, the KMS key policy must also grant the same service principal the kms:Encrypt and kms:Decrypt permissions. This combination allows the cross-account delivery service to write encrypted objects directly into the logging account's bucket.

Answer

Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

Answer

Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

Answer

In the source account, create a KMS key and allow the logging account to use it for encryption.

Question 13

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

Accepted Answer

Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.. A Service Control Policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the ec2:RunInstances action unless the request includes the required 'CostCenter' tag. This enforces the tagging requirement across all accounts in the organization without needing per-account IAM policies, and it cannot be overridden by account administrators.

Answer

Create an IAM policy in each account that requires the tag for ec2:RunInstances.

Answer

Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

Answer

Configure the EC2 service to automatically add the tag to all instances.

Question 14

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.. AWS Organizations Service Control Policies (SCPs) allow the central IT team to define a permission guardrail that explicitly denies actions on networking resources (e.g., ec2:CreateVpc, ec2:DeleteSubnet) for developer accounts. SCPs are applied at the account or organizational unit level and cannot be overridden by any IAM policy within the account, ensuring developers cannot modify networking resources even if they have full administrative access.

Answer

Use IAM roles to grant developers access only to their own resources.

Answer

Use AWS Config rules to detect changes to networking resources.

Answer

Use resource tags to identify networking resources and apply IAM conditions.

Question 15

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.. The 'Enable for all accounts in my organization' option in CloudTrail automatically creates a trail that applies to all accounts in the AWS Organization, delivering logs from every account to the specified S3 bucket in the management account without requiring per-account configuration. Option E is correct because the S3 bucket policy must explicitly grant the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects from any AWS account in the organization, ensuring cross-account delivery succeeds.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.