SAP-C02 Design Solutions for Organizational Complexity Practice Test 5 — 15 Questions

Question 1

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.. Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 2

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Accepted Answer

Use separate AWS accounts for each environment to provide strong isolation.. Using separate AWS accounts for each environment provides strong isolation at the AWS account boundary, which is the most secure and recommended practice for preventing production workloads from being impacted by changes in other environments. Account-level isolation ensures that IAM policies, resource limits, and service quotas are independent, and that no cross-account resource sharing can accidentally affect production.

Answer

Allow all users to assume cross-account roles for easier management.

Answer

Share the same VPC across all OUs to simplify networking.

Answer

Use resource tagging to isolate environments instead of accounts.

Question 3

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

Accepted Answer

The policy denies all instance types except t3.micro and t3.small.. The IAM policy includes a Deny statement that explicitly denies ec2:RunInstances for any instance type that is not t3.micro or t3.small. Since the developer is attempting to launch a t3.medium instance, which is not listed in the allowed types, the Deny statement matches and overrides any Allow, resulting in an AccessDenied error. This is the most likely reason because explicit Deny always takes precedence over Allow in IAM policy evaluation logic.

Answer

The policy has a syntax error that causes all actions to be denied.

Answer

The policy does not explicitly allow ec2:RunInstances.

Answer

The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.

Question 4

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

Accepted Answer

The bucket policy restricts access to a specific account only.. The bucket policy restricts access to a specific AWS account (e.g., `"AWS": "111122223333"`), which only grants access to the account's root user, not to IAM roles. For the cross-account IAM role 'LogDelivery' to write logs, the bucket policy must explicitly allow the role's ARN or use `"AWS": "arn:aws:iam::111122223333:root"` to include all IAM principals in the account. Since the policy only allows the account root, the role is denied, causing the delivery failure. Option B is correct because the policy's account-only restriction does not cover the role.

Answer

The bucket policy lacks s3:GetObject permission.

Answer

The IAM role is not trusted by the bucket policy.

Answer

The bucket policy has an explicit deny that overrides the allow.

Question 5

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

Accepted Answer

The account has an unpaid AWS bill.. When an AWS account is suspended, the most common reason is an unpaid bill. AWS suspends accounts that have outstanding charges beyond the payment due date, disabling access to resources until the balance is paid. The command output showing the 'Prod' account as 'SUSPENDED' directly indicates a billing issue, as AWS does not suspend accounts for SCP violations, security breaches, or removal from an organization in the same manner.

Answer

The account was suspended due to a Service Control Policy (SCP) violation.

Answer

The account was suspended due to a security breach detected by AWS.

Answer

The account was removed from the organization by the root user.

Question 6

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

Accepted Answer

Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.. A service control policy (SCP) can deny the s3:CreateBucket action unless the request includes a 'CostCenter' tag, using the 'aws:RequestTag' condition key. This enforces tagging at the point of creation across all accounts in the organization, preventing untagged buckets from being created in the first place, which is the most operationally efficient approach as it avoids the need for remediation or post-creation tagging.

Answer

Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

Answer

Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

Question 7

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

Accepted Answer

Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.. AWS CloudTrail can be configured to deliver logs from multiple accounts to a single central S3 bucket in a logging account by setting up a CloudTrail trail in each account that points to the same bucket. This approach requires minimal administrative overhead as it leverages native AWS cross-account logging capabilities without additional data movement or transformation services.

Answer

Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.

Answer

Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.

Question 8

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

Accepted Answer

Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.. AWS Transit Gateway allows you to centralize network connectivity across multiple VPCs and accounts. By creating the Transit Gateway in the networking account and sharing it via AWS Resource Access Manager (RAM), you enable individual account owners to attach their VPCs to the shared Transit Gateway, achieving private communication while maintaining centralized management.

Answer

Create a VPN connection from each VPC to a central network appliance.

Answer

Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

Answer

Create VPC peering connections between each VPC and a central VPC.

Question 9

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

Accepted Answer

Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.. A multi-region key is not needed, and cross-account access requires key policy. Option A is wrong because SSE-S3 does not allow cross-account access control. Option B is wrong because SSE-C requires managing keys externally. Option D is wrong because S3 bucket policies cannot grant access to KMS keys.

Answer

Use SSE-S3 encryption. Grant cross-account access via bucket policy.

Answer

Use SSE-C encryption. Provide the same customer key to all accounts.

Answer

Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

Question 10

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

Accepted Answer

Use the IAM Identity Center console to add the member account as a delegated administrator.. AWS IAM Identity Center allows you to designate a member account as a delegated administrator directly from the IAM Identity Center console in the management account. This grants the member account the necessary permissions to manage users, groups, and permission sets without requiring cross-account roles or resource sharing.

Answer

Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.

Answer

Use a service control policy to allow the member account to manage IAM Identity Center.

Answer

Create an IAM role in the management account and allow the member account to assume it.

Question 11

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.. SCPs provide preventive, account-level enforcement that blocks unauthorized EC2 instance launches before they occur, while CloudFormation hooks add a second layer of preventive control at the infrastructure-as-code level. This combination is the most scalable for 500+ accounts because SCPs are applied centrally via AWS Organizations and CloudFormation hooks operate at deployment time, ensuring no non-compliant instance is ever created.

Answer

Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

Answer

Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 12

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

Accepted Answer

Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.. AWS Resource Access Manager (RAM) allows you to share AWS Managed Microsoft AD directories across accounts without duplicating the directory or managing multiple trust relationships. This provides a single, centrally managed directory that multiple VPCs in different accounts can authenticate against, ensuring scalability and security by avoiding cross-account credential replication or complex VPN meshes.

Answer

Set up a VPN connection from each VPC to the on-premises AD.

Answer

Clone the directory and deploy it in each account.

Answer

Deploy an AD Connector in each VPC pointing to the on-premises AD.

Question 13

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

Accepted Answer

Use cost allocation tags to tag resources with a department tag.. Cost allocation tags allow you to tag AWS resources with metadata (e.g., department name) and then activate those tags in the AWS Billing and Cost Management console. Once activated, AWS generates cost reports that break down spending by those tags, enabling the finance team to map costs to each department's account. This is the native, recommended approach for cost attribution across accounts in AWS Organizations.

Answer

Use Amazon CloudWatch custom metrics to record department IDs.

Answer

Use service control policies (SCPs) to restrict costs per account.

Answer

Use AWS Budgets to create budgets per department.

Question 14

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

Accepted Answer

Use Amazon Athena with Lambda User-Defined Functions (UDFs) to redact data during query execution.. Amazon Athena with Lambda UDFs allows you to redact sensitive IP addresses at query time without modifying the underlying data in S3. This approach is highly scalable as it leverages Athena's serverless query engine and Lambda's stateless compute, enabling on-the-fly redaction across petabytes of VPC Flow Logs stored centrally in the logging account.

Answer

Create a Lambda function in each member account to redact logs before delivery.

Answer

Use S3 Object Lambda to redact sensitive data when objects are read.

Answer

Use Amazon Kinesis Data Firehose to transform data before writing to S3.

Question 15

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

Accepted Answer

Create a backup vault in the management account and share it with member accounts.. Options C and E are correct. Option A is incorrect because IAM roles are not created automatically for AWS Backup; instead, the backup policy is applied via AWS Organizations. Option B is incorrect because a single backup policy can be applied to the entire organization or specific organizational units, not per account. Option D is incorrect because the backup vault should be in the management account, not in each member account. Option E is correct because enabling AWS Backup as a trusted service within AWS Organizations allows the management account to centrally manage backup policies across member accounts. Option C is correct because sharing the backup vault from the management account allows member accounts to store backups in the central vault.

Answer

Create IAM roles in each member account to allow AWS Backup to assume them.

Answer

Create a separate backup policy for each member account.

Answer

Create a backup vault in each member account and aggregate them using AWS Config.