SAP-C02 Design Solutions for Organizational Complexity Practice Test 5 — 15 Questions

Question 1

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP to deny disabling AWS Config, and use an AWS Config conformance pack in a delegated admin account to enforce rules across the organization.. It combines an SCP to prevent disabling AWS Config with an AWS Config conformance pack deployed from a delegated admin account, which automatically applies to all existing and new member accounts in the organization. This approach is fully automated, requires no manual intervention for new accounts, and enforces both the enablement of Config and the required rules across the entire organization.

Answer

Create an AWS Config aggregator in the management account and enable Config for each account manually.

Answer

Use AWS CloudFormation StackSets to deploy a Config template to each account, and manually add new accounts to the StackSet.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail to enable Config and deploy rules whenever a new account is created.

Question 2

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

Accepted Answer

Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.. It uses Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account's private hosted zone, enabling centralized management of DNS records across accounts. This approach provides high availability and supports cross-account DNS resolution.

Answer

Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.

Answer

Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.

Answer

Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.

Question 3

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

Accepted Answer

Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.. Delivering logs from all accounts to a central Amazon S3 bucket in a logging account is the most scalable and cost-effective approach. S3 Lifecycle policies can automatically transition older logs to Amazon S3 Glacier, reducing storage costs while retaining data for compliance. This design avoids cross-account data transfer fees and minimizes operational overhead by using a single bucket with centralized access controls.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.

Answer

Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.

Question 4

A company uses AWS Organizations with a multi-account strategy. The security team wants to restrict the use of specific instance types across all accounts. What is the MOST effective way to enforce this policy?

Accepted Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not allowed, and attach it to the root organizational unit.. A Service Control Policy (SCP) attached to the root organizational unit (OU) can centrally deny the ec2:RunInstances action for non-approved instance types across all member accounts without requiring per-account configuration. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users in the affected accounts, making them the most effective mechanism for enforcing organization-wide restrictions on instance types.

Answer

Create an IAM policy in each account that denies launching non-approved instance types.

Answer

Use AWS Config rules to detect non-compliant instances and trigger an AWS Lambda function to terminate them.

Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances for all users and then attach it to the root OU.

Question 5

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

Accepted Answer

Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.. It combines an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket with a bucket policy that denies s3:DeleteObject for all principals except the management account. This layered approach ensures that even if an account has full administrative permissions, the SCP blocks the CloudTrail and S3 actions, while the bucket policy prevents any account (including the root user) from deleting log files, with the management account as the sole exception for recovery purposes.

Answer

Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.

Answer

Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.

Answer

Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.

Question 6

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

Accepted Answer

Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.. A service control policy (SCP) can be applied at the root, OU, or account level in AWS Organizations to deny the creation of resources that do not have the required cost allocation tags. This enforces tagging proactively at the API call level, preventing untagged resources from being created in the first place, which is the most effective approach for central enforcement.

Answer

Use AWS Budgets to alert on untagged resources.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.

Answer

Create an AWS Lambda function that tags resources after they are created.

Question 7

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Accepted Answer

Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.. Option A is correct because an S3 bucket policy using the aws:SourceVpce condition key enforces that requests to the bucket must originate through a specific VPC endpoint, which is a core mechanism for building a data perimeter that restricts data access to approved network locations. Option D is correct because an SCP applied at the organization level can deny access to resources unless the request originates from the approved IP address range, providing a centralized guardrail across all accounts in the AWS Organization. Option B is not correct because IAM policies in each account are not centrally enforced across the organization and are more cumbersome to manage than an SCP for this organization-wide data perimeter requirement. Option C is not correct because AWS PrivateLink enables private connectivity to services but does not by itself restrict data access to approved network locations. Option E is not correct because AWS Resource Access Manager shares resources with accounts, not network locations, and does not enforce network-based access restrictions.

Answer

Create an IAM policy in each account that denies access unless the request comes from the approved IP range.

Answer

Use AWS PrivateLink to access all AWS services from within the VPC.

Answer

Use AWS Resource Access Manager to share resources with approved accounts only.

Question 8

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Accepted Answer

Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.. Option B is correct because Security Hub uses a delegated administrator model: enabling Security Hub in the security account and designating it as the administrator for the AWS Organization lets it aggregate findings from all member accounts into that central account. Option C is correct because GuardDuty aggregation requires the security account to enable GuardDuty and then add the member accounts (via the GuardDuty API CreateMembers/InviteMembers or, in an organization, auto-enable), so all member detectors send findings to the central administrator. Option D is correct because IAM Access Analyzer supports an organization-level zone of trust; enabling it in the security account with the organization as the zone of trust lets it analyze and aggregate findings across all accounts in the organization. Option A is not correct because an AWS Config aggregator collects configuration items and compliance data, not GuardDuty, Security Hub, or Access Analyzer findings. Option E is not correct because a single GuardDuty detector is Region-specific; monitoring all Regions requires enabling GuardDuty in each Region (or using organization auto-enable), not one detector covering all Regions.

Answer

Use AWS Config aggregator in the security account to collect configuration items from all accounts.

Answer

Configure GuardDuty in the security account to monitor all regions by using a single detector.

Question 9

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Accepted Answer

Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.. Option D is correct because, when using AWS Organizations with Systems Manager, a service-linked role or IAM service role for Systems Manager must exist in each member account so that Systems Manager can perform actions such as patching on the instances in those accounts; attaching AmazonSSMManagedInstanceCore grants the required permissions for the managed instance role. Option E is correct because centralized patch management across accounts is achieved by creating the maintenance window in the management account (or a delegated administrator account) and targeting instances across accounts using AWS Resource Groups that span accounts, which is the supported cross-account targeting mechanism. Option A is not required as a separate action because the SSM Agent is preinstalled on many modern Amazon Machine Images and the question asks for the two required actions for centralized cross-account Patch Manager management, not agent installation. Option B is not required because AWS Config is used for compliance tracking and recording, not for enabling Patch Manager to patch instances. Option C is not required because the instance profile with AmazonSSMManagedInstanceCore is needed for the instance to be managed, but the question specifically asks for the two actions required for centralized cross-account Patch Manager management, and the correct answers focus on the service role in member accounts and the cross-account maintenance window targeting.

Answer

Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

Answer

Enable AWS Config in all accounts to track patch compliance.

Answer

Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

Question 10

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

Accepted Answer

The EC2 instance launch will be denied because the SCP denies actions in regions not listed.. SCPs are evaluated using a deny-by-default model where any action not explicitly allowed is implicitly denied. The SCP in question denies all EC2 actions in any region not listed in the allow list (us-east-1 and eu-west-1). Since ap-southeast-1 is not in that list, the EC2 launch is denied regardless of any IAM permissions the developer may have.

Answer

The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

Answer

The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

Answer

The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

Question 11

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

Accepted Answer

The workload account must configure security groups for the EC2 instance to allow traffic to the RDS database's security group.. When an EC2 instance is launched into a shared subnet via AWS RAM, the workload account can manage its own security groups, but the underlying VPC and its route tables remain under the management of the VPC owner. Since the instance and the RDS database are in the same VPC, no inter-VPC connectivity (like VPC peering or Transit Gateway) is needed. The only missing piece is that the workload account must configure its EC2 instance's security group to allow outbound traffic to the RDS database's security group, and the RDS database's security group must allow inbound traffic from the EC2 instance's security group, both of which are standard security group rules within the same VPC.

Answer

The workload account must create a route table entry in the shared VPC to allow communication.

Answer

Establish a VPC peering connection between the workload account's VPC and the shared VPC.

Answer

Attach an AWS Transit Gateway to both VPCs to enable communication.

Question 12

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

Accepted Answer

The bucket policy only grants access to the root user of account 123456789012, not to other accounts.. The bucket policy in the exhibit uses a Principal element of `"AWS": "arn:aws:iam::123456789012:root"`. This grants access only to the root user of account 123456789012, not to any IAM users or roles in that account, and certainly not to any principals in account 111111111111. When the developer from account 111111111111 attempts to access the object with a signed request (no --no-sign-request), the request is signed with credentials from that account, which are not listed in the Principal, so S3 denies the request.

Answer

The bucket policy denies access from all accounts except 123456789012.

Answer

The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.

Answer

The request is not signed, so it is denied by the aws:SecureTransport condition.

Question 13

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.. It combines a Service Control Policy (SCP) to proactively deny any PutBucketEncryption action that does not specify SSE-KMS, preventing non-compliant buckets from being created, and AWS Config with a custom rule and automatic remediation via Lambda to detect and fix existing non-compliant buckets. This dual approach ensures both prevention and remediation across all accounts in the AWS Organization, meeting the security team's enforcement requirement.

Answer

Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.

Answer

Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.

Answer

Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.

Question 14

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

Accepted Answer

Create a StackSet that references an Amazon S3 bucket containing a JSON file with account-specific parameters, including unique CIDR blocks for each account.. CloudFormation StackSets can reference an Amazon S3 bucket containing a JSON file with account-specific parameters, allowing each account to receive a unique, non-overlapping CIDR block. This approach is fully automated, scalable to 50 accounts, and avoids manual parameter entry or custom code maintenance.

Answer

Use AWS Service Catalog to create a product that deploys the VPC, and share the portfolio with each account.

Answer

Write a custom AWS Lambda function that iterates through each account and deploys the CloudFormation template with a different CIDR.

Answer

Create a StackSet with a single parameter for the CIDR block and deploy it to all accounts.

Question 15

A company has a centralized logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all member accounts in AWS Organizations. The logs are stored in an S3 bucket in the logging account. Security analysts need to query these logs using Amazon Athena. What is the MOST efficient way to set up the table partitions?

Accepted Answer

Use AWS Glue Crawler to create a table, then manually add partitions for each account ID and region.. VPC Flow Logs, CloudTrail, and AWS Config logs are stored in S3 with key prefixes that include account ID, region, and date (e.g., AWSLogs/{account-id}/CloudTrail/{region}/{year}/{month}/{day}/). To efficiently query these logs in Athena, partitions should be created on account ID and region to enable partition pruning, reducing the amount of data scanned. Manually adding partitions for each account ID and region ensures precise control and avoids the overhead of crawling all historical data, which is more efficient than relying solely on automatic date-based partitioning.

Answer

Use AWS Glue Crawler to create a table with no partitions, and query the entire dataset each time.

Answer

Use AWS Glue Crawler to automatically create partitions based on the date prefix in the S3 key.

Answer

Use AWS Glue Crawler to create a table partitioned by log type and date.