SAP-C02 Design Solutions for Organizational Complexity Practice Test 4 — 15 Questions

Question 1

A company uses AWS Organizations with a policy that denies access to services unless they are explicitly allowed. The security team wants to allow only approved services. What type of policy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SCP with a Deny effect for all services except approved ones.. To implement a deny-by-default model where only approved services are allowed, you need a policy that denies all services except those explicitly approved. An SCP with a Deny effect for all services except approved ones effectively creates a whitelist. Option C is incorrect because it only denies specific unapproved services, leaving all other unapproved services allowed by default, which does not achieve the goal of only allowing approved services.

Answer

Use an SCP with an Allow effect for approved services.

Answer

Use an SCP with a Deny effect for unapproved services.

Answer

Use an IAM policy with a Deny effect for unapproved services.

Question 2

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

Accepted Answer

Register the member account as a delegated administrator for GuardDuty.. Option B is correct because delegating GuardDuty administration requires explicitly registering the chosen member account as the delegated administrator using the AWS Organizations RegisterDelegatedAdministrator API or the GuardDuty console, which grants it administrative permissions over GuardDuty across the organization. Option C is correct because GuardDuty must first be enabled in the management account before a delegated administrator can be designated, since the management account is the one that performs the registration and must have GuardDuty active to manage the organization-wide configuration. Option A is incorrect because the delegated administrator must be a member account, not the management account, since the whole purpose is to offload administration away from the management account. Option D is incorrect because delegating GuardDuty administration does not require a custom SCP allowing GuardDuty actions; the delegated administrator's permissions come from the registration mechanism, not from SCPs. Option E is incorrect because GuardDuty does not need to be enabled in every member account beforehand; once a delegated administrator is registered, it can enable GuardDuty across all accounts in the organization automatically.

Answer

The delegated administrator must be the management account.

Answer

Create an SCP that allows GuardDuty actions in the member account.

Answer

Enable GuardDuty in all member accounts.

Question 3

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

Accepted Answer

The subnet must be created by the owning account.. Option A is correct because AWS RAM requires the resource owner account to create and own the subnet before it can be shared; you cannot share a subnet you do not own. Option B is correct because, unless the resource share is created with automatic acceptance (e.g., via AWS Organizations with sharing enabled), consumer accounts must accept the resource share invitation before they can use the shared subnet. Option C is correct because VPC sharing via AWS RAM is Region-scoped: the VPC and the shared subnet must reside in the same AWS Region as the participants, since subnets are Regional resources and cannot be shared across Regions. Option D is incorrect because consumer accounts do not create their own subnet in the shared VPC; they simply launch resources into the subnet that was shared with them. Option E is incorrect because there is no 'VPC sharing' toggle in the AWS Organizations console; sharing is enabled through AWS RAM resource shares (optionally with Organizations integration for auto-acceptance).

Answer

Each consumer account must create a subnet in the same VPC.

Answer

Enable VPC sharing in the AWS Organizations console.

Question 4

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

Accepted Answer

Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.. CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

Answer

Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.

Answer

Configure the bucket ACL to allow write access for all member account root users.

Answer

Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.

Question 5

A company uses AWS Organizations with a hierarchical OU structure. The security OU has an SCP that denies all actions except those explicitly allowed. The development OU has an SCP that allows all actions. A developer account in the development OU tries to launch an EC2 instance but receives an access denied error. The IAM user in the developer account has full administrator permissions. What is the most likely cause?

Accepted Answer

An SCP at the root level denies EC2 actions.. The most likely cause is an SCP at the root level that denies EC2 actions. In AWS Organizations, SCPs are evaluated hierarchically: an explicit deny at the root level overrides any allow from a lower-level OU or account-level policy. Even though the development OU has an SCP that allows all actions, the root-level SCP (which denies all actions except those explicitly allowed) will block EC2 actions unless EC2 is explicitly allowed in that root SCP. The IAM user's full administrator permissions are irrelevant because SCPs act as a permission boundary that cannot be bypassed by account-level IAM policies.

Answer

The SCP at the development OU level denies EC2 actions.

Answer

The IAM user does not have MFA enabled, and an SCP requires MFA.

Answer

An SCP at the root level requires encryption on EC2 instances, which is not satisfied.

Question 6

A company is using AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have a specific AWS Config rule enabled and that any drift is automatically remediated. Which approach should be used?

Accepted Answer

Use AWS Control Tower lifecycle events and customizations to deploy the Config rule and set up automatic remediation.. AWS Control Tower provides lifecycle events and customizations (via AWS Control Tower Lifecycle Events and Customizations for AWS Control Tower) that allow you to automatically deploy and remediate AWS Config rules across all accounts in the organization. This approach ensures that the Config rule is applied consistently when new accounts are created or when drift is detected, meeting the security team's requirement for automatic remediation without manual intervention.

Answer

Use EC2 Auto Scaling to apply the Config rule to all accounts.

Answer

Use AWS CloudTrail to monitor for accounts without the Config rule and trigger a Lambda function to add it.

Answer

Use AWS Config to create a conformance pack that applies the rule, and use an SCP to require it.

Question 7

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

Accepted Answer

Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.. It uses a cross-account destination in the logging account with subscription filters in the source accounts, which is the standard pattern for streaming CloudWatch Logs across accounts. The KMS key policy must grant the CloudWatch Logs service in the source accounts permission to use the key (via kms:Encrypt and kms:Decrypt) so that logs can be encrypted at rest in the logging account while only the logging account manages the key.

Answer

Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.

Answer

Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.

Answer

Use the default AWS-managed KMS key for CloudWatch Logs in each source account.

Question 8

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the transit gateway with authorized accounts.. AWS Resource Access Manager (RAM) allows the network account to share the transit gateway with specific application accounts, enabling them to create attachments without granting them ownership or management of the transit gateway itself. This approach ensures that only authorized accounts can create VPC attachments to the shared transit gateway, as the sharing is controlled at the resource level and can be revoked at any time.

Answer

Use AWS Direct Connect to connect each application account to the transit gateway.

Answer

Establish VPC peering connections between each application account and the network account.

Answer

Create an SCP that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account.

Question 9

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

Accepted Answer

Use AWS SSO to assign the finance group to the finance OU accounts only.. AWS SSO (now AWS IAM Identity Center) allows you to assign users or groups to specific AWS accounts and OUs directly. By assigning the finance group only to the finance OU accounts, you enforce that those users can only access those accounts via the SSO portal, without needing additional SAML attributes or SCPs. This is the simplest and most direct method for controlling account access based on group membership.

Answer

Configure the external IdP to send a SAML attribute that AWS uses to enforce permissions.

Answer

Create an SCP that denies access to non-finance accounts for users from the finance group.

Answer

Create IAM roles in each finance account and trust the IdP with a condition on the group attribute.

Question 10

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

Accepted Answer

Use tag policies in AWS Organizations to enforce required tags on resources.. Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.

Answer

Define cost allocation tags in the management account and activate them for all accounts.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Use an SCP that denies resource creation if the required tags are not present.

Question 11

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

Accepted Answer

Add a bucket policy on the central S3 bucket that grants the service principal 'delivery.logs.amazonaws.com' s3:PutObject permission.. Option A is correct because VPC Flow Logs publish to S3 using the service principal delivery.logs.amazonaws.com, so the central bucket's bucket policy must explicitly grant that principal s3:PutObject (and typically s3:GetBucketAcl) to allow cross-account delivery. Option D is correct because each member account must actually create the Flow Log subscription with an S3 destination ARN pointing to the central bucket in the logging account, which is what initiates delivery. Option B is unnecessary since Flow Logs use the delivery.logs.amazonaws.com service principal rather than an assumed IAM role in the logging account. Option C is wrong because Flow Logs can be delivered directly to a cross-account S3 bucket; per-account buckets with replication are not required. Option E is irrelevant because CloudTrail aggregates API activity logs, not VPC Flow Logs.

Answer

Create an IAM role in the logging account that the member accounts can assume to put objects.

Answer

Create an S3 bucket in each member account to receive Flow Logs, and replicate to the central bucket.

Answer

Enable AWS CloudTrail in the management account to aggregate logs.

Question 12

A company is using AWS Organizations with multiple OUs. The security team wants to ensure that no account can delete CloudTrail trails or S3 bucket policies. Which THREE SCP strategies should be combined?

Accepted Answer

Attach an SCP to the root that explicitly denies cloudtrail:DeleteTrail and s3:PutBucketPolicy.. The correct strategy is to attach an SCP to the root that explicitly denies the `cloudtrail:DeleteTrail` and `s3:PutBucketPolicy` actions. SCPs act as a service control boundary that overrides any IAM-based permissions, and explicit deny statements in SCPs cannot be overridden by any account within the organization. Option D is incorrect because SCP order does not affect evaluation; all applicable SCPs are evaluated and any explicit deny takes precedence. Option E is invalid as SCPs cannot use 'deny all except' logic; they must explicitly allow or deny specific actions.

Answer

Use IAM policies with conditions to restrict deletion to certain IP addresses.

Answer

Attach an SCP to the root that allows all actions, and rely on IAM policies in each account.

Answer

Ensure that the SCPs are evaluated in the correct order, with deny statements taking precedence.

Answer

Attach an SCP that denies all actions except those necessary for CloudTrail and S3 operations.

Question 13

Refer to the exhibit. A company applies this S3 bucket policy to a central logging bucket. CloudTrail trails in multiple accounts are configured to deliver logs to this bucket. Recently, logs stopped being delivered. What is the most likely cause?

Accepted Answer

CloudTrail does not automatically set the 'bucket-owner-full-control' ACL when delivering logs.. When CloudTrail delivers logs to an S3 bucket owned by a different account, it does not automatically set the 'bucket-owner-full-control' ACL on the delivered objects. Without this ACL, the bucket owner (the central logging account) does not have full control over the objects, and the bucket policy's Deny statement (which requires s3:GetObjectAcl and s3:PutObjectAcl for bucket-owner-full-control) will block access, causing log delivery to fail. The solution is to configure CloudTrail to apply the 'bucket-owner-full-control' canned ACL or modify the bucket policy to grant the bucket owner full control via a different mechanism.

Answer

The Principal element uses 'cloudtrail.amazonaws.com' which is not the correct service principal.

Answer

The Resource ARN does not include the account ID, so it matches all accounts.

Answer

The policy uses 'Deny' which is not allowed in S3 bucket policies.

Question 14

Refer to the exhibit. A company runs this CLI command and sees the output. Which account is the management account?

Accepted Answer

111111111111. The management account in AWS Organizations is the account that created the organization and has the ID displayed in the `management-account-id` field of the `aws organizations describe-organization` output. In the exhibit, this field shows `111111111111`, making option D correct.

Answer

333333333333

Answer

222222222222

Answer

o-example1

Question 15

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

Accepted Answer

All principals outside the organization are denied all actions.. The SCP explicitly denies all actions (`ec2:*`, `s3:*`, etc.) to any principal outside the organization by using a `Condition` block with `aws:PrincipalOrgID` set to the organization's ID. This effectively blocks any request from an IAM user, role, or federated principal that is not a member of the specified AWS Organization. The `Deny` effect overrides any allow, so all actions are denied for external principals.

Answer

All principals are required to have MFA enabled.

Answer

All principals in the organization are allowed all actions.

Answer

All principals in the organization are denied all actions.