SAP-C02 Design Solutions for Organizational Complexity Practice Test 4 — 15 Questions

Question 1

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

Accepted Answer

The bucket policy restricts access to a specific account only.. Option D is correct because the bucket policy only allows the LogDelivery role from account 111122223333, but the logs may be coming from a different account (e.g., the source account of the logs). Option A is wrong because the policy does not deny, it allows. Option B is wrong because the policy is correct for the given role. Option C is wrong because the policy allows PutObject, not GetObject.

Answer

The bucket policy lacks s3:GetObject permission.

Answer

The IAM role is not trusted by the bucket policy.

Answer

The bucket policy has an explicit deny that overrides the allow.

Question 2

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

Accepted Answer

The account has an unpaid AWS bill.. Option C is correct because accounts are typically suspended due to non-payment of AWS bills. Option A is wrong because AWS Organizations does not suspend accounts for SCP violations. Option B is wrong because nothing in the output indicates a service compromise. Option D is wrong because the account was created after the management account, so it was not the root.

Answer

The account was suspended due to a Service Control Policy (SCP) violation.

Answer

The account was suspended due to a security breach detected by AWS.

Answer

The account was removed from the organization by the root user.

Question 3

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

Accepted Answer

Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.. Option A is correct because SCPs can enforce tagging at the API level across all accounts in the organization. Option B is wrong because Lambda functions require manual setup per account. Option C is wrong because AWS Config rules only detect non-compliance, not prevent creation. Option D is wrong because CloudFormation StackSets require manual template application.

Answer

Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

Answer

Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

Question 4

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

Accepted Answer

Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.. Option B is correct because it centralizes logs with minimal overhead. Option A is wrong because separate buckets require more management. Option C is wrong because CloudWatch Logs in each account lacks centralization. Option D is wrong because Kinesis Firehose adds unnecessary complexity.

Answer

Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.

Answer

Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.

Question 5

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

Accepted Answer

Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.. Option D is correct because it allows centralized management with self-service via Resource Access Manager. Option A is wrong because VPNs are not scalable. Option B is wrong because VPC peering does not scale to hundreds of accounts. Option C is wrong because VPC endpoints are for services, not VPC-to-VPC.

Answer

Create a VPN connection from each VPC to a central network appliance.

Answer

Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

Answer

Create VPC peering connections between each VPC and a central VPC.

Question 6

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

Accepted Answer

Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.. Option C is correct because a multi-region key is not needed, and cross-account access requires key policy. Option A is wrong because SSE-S3 does not allow cross-account access control. Option B is wrong because SSE-C requires managing keys externally. Option D is wrong because S3 bucket policies cannot grant access to KMS keys.

Answer

Use SSE-S3 encryption. Grant cross-account access via bucket policy.

Answer

Use SSE-C encryption. Provide the same customer key to all accounts.

Answer

Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

Question 7

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

Accepted Answer

Use the IAM Identity Center console to add the member account as a delegated administrator.. Option B is correct because IAM Identity Center can register member accounts as delegated administrators. Option A is wrong because IAM roles cannot manage IAM Identity Center. Option C is wrong because SCPs are not for delegation. Option D is wrong because RAM does not share IAM Identity Center.

Answer

Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.

Answer

Use a service control policy to allow the member account to manage IAM Identity Center.

Answer

Create an IAM role in the management account and allow the member account to assume it.

Question 8

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.. Option D is correct because SCPs deny non-compliant API calls, and CloudFormation hooks prevent non-compliant stacks. Option A is wrong because Config is detective, not preventive. Option B is wrong because Lambda triggered by CloudTrail is reactive. Option C is wrong because Systems Manager is not for enforcement at launch time.

Answer

Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

Answer

Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 9

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

Accepted Answer

Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.. Option A is correct because sharing the directory via RAM allows cross-account access. Option B is wrong because AD Connector per VPC adds management overhead. Option C is wrong because VPNs are not needed for this. Option D is wrong because directory cloning is not for cross-account access.

Answer

Set up a VPN connection from each VPC to the on-premises AD.

Answer

Clone the directory and deploy it in each account.

Answer

Deploy an AD Connector in each VPC pointing to the on-premises AD.

Question 10

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

Accepted Answer

Use cost allocation tags to tag resources with a department tag.. Option C is correct because cost allocation tags are the standard method. Option A is wrong because CloudWatch is for monitoring, not cost tracking. Option B is wrong because SCPs are for permissions. Option D is wrong because Budgets can alert but not map costs.

Answer

Use Amazon CloudWatch custom metrics to record department IDs.

Answer

Use service control policies (SCPs) to restrict costs per account.

Answer

Use AWS Budgets to create budgets per department.

Question 11

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

Accepted Answer

Use Amazon Athena with Lambda User-Defined Functions (UDFs) to redact data during query execution.. Option B is correct because Athena queries can use Lambda UDFs to redact data on the fly. Option A is wrong because S3 Object Lambda is for object-level transformations, not query-time. Option C is wrong because it's not scalable to run a script on each account. Option D is wrong because Kinesis adds complexity and is not necessary.

Answer

Create a Lambda function in each member account to redact logs before delivery.

Answer

Use S3 Object Lambda to redact sensitive data when objects are read.

Answer

Use Amazon Kinesis Data Firehose to transform data before writing to S3.

Question 12

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

Accepted Answer

Create a backup vault in the management account and share it with member accounts.. Options B and C are correct. Option A is wrong because the backup policy is applied to the organization, not per account. Option D is wrong because the backup vault must be in the management account. Option E is wrong because IAM roles are not created automatically for AWS Backup.

Answer

Create IAM roles in each member account to allow AWS Backup to assume them.

Answer

Create a separate backup policy for each member account.

Answer

Create a backup vault in each member account and aggregate them using AWS Config.

Question 13

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

Accepted Answer

Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.. Options A and D are correct. Option B is wrong because VPC peering is not transitive; a Transit Gateway handles many VPCs. Option C is wrong because direct Lambda access would bypass security groups. Option E is wrong because the RDS should not be public.

Answer

Use AWS Lambda to proxy database requests from member accounts.

Answer

Make the RDS instance publicly accessible and use IAM authentication.

Answer

Create a VPC peering connection between each member VPC and the shared services VPC.

Question 14

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Accepted Answer

Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.. Options A, C, and D are correct. Option B is wrong because CloudTrail is logging, not preventive. Option E is wrong because SCPs cannot enforce approval workflows.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

Answer

Enable AWS CloudTrail to log all IAM role creation events.

Question 15

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Accepted Answer

Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.. Options A, C, and D are correct. Option B is wrong because VPC peering is not needed if Transit Gateway is used. Option E is wrong because Route 53 Resolver endpoints are for hybrid, not inter-VPC.

Answer

Route 53 Resolver inbound endpoints in the shared services VPC.

Answer

VPC peering connections between each VPC and the shared services VPC.