SAP-C02 Design Solutions for Organizational Complexity Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

Accepted Answer

The principal should be the CloudTrail service principal, not the root account of 111111111111.. Option D is correct because CloudTrail uses a service principal, not the root account. Option A is wrong because the policy allows PutObject. Option B is wrong because CloudTrail delivers logs with bucket-owner-full-control. Option C is wrong because the resource is correct.

Answer

The resource ARN is incorrect.

Answer

The bucket policy requires the x-amz-acl header, which CloudTrail does not set.

Answer

The bucket policy does not allow s3:PutObject for the account 222222222222.

Question 2

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

Accepted Answer

The SCP applies to the production account because it is attached to the root.. Option A is correct because SCPs affect all accounts in the organization. Option B is wrong because SCPs do not affect management account. Option C is wrong because the production account is not the management account. Option D is wrong because SCPs override IAM permissions.

Answer

The production account's IAM policy denies s3:DeleteBucket.

Answer

The SCP only applies to the management account.

Answer

The production account is the management account.

Question 3

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an organization trail in the management account with CloudTrail.. Option C is correct because AWS CloudTrail can be configured in the management account to log all accounts in the organization. Option A is wrong because it requires creating trails in each account manually. Option B is wrong because CloudWatch Logs does not capture API calls. Option D is wrong because S3 access logs record S3 operations only.

Answer

Enable CloudWatch Logs in each account and stream to a central log group.

Answer

Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Enable S3 server access logs on all accounts and send to a central bucket.

Question 4

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

Accepted Answer

Use AWS Config rules to check AMI IDs against a parameter store and auto-remediate.. Option D is correct because AWS Config rules in each account can check the AMI ID against a centralized parameter store. Option A is wrong because SCPs cannot enforce AMI IDs. Option B is wrong because it requires manual tagging. Option C is wrong because IAM policies cannot restrict AMI IDs based on source account.

Answer

Tag approved AMIs and use IAM policies to require that tag.

Answer

Use an IAM policy in each account to allow only specific AMI IDs.

Answer

Use an SCP to deny ec2:RunInstances unless the AMI ID matches an approved list.

Question 5

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

Accepted Answer

Use AWS Organizations with a delegated administrator for IAM.. Option B is correct because AWS Organizations allows you to create service-linked roles and delegate administration. Option A is wrong because it gives full admin. Option C is wrong because it does not scale across accounts. Option D is wrong because it is not for role creation.

Answer

Use AWS Single Sign-On with permission sets.

Answer

Create an IAM user in each account with AdministratorAccess.

Answer

Use cross-account roles with a policy that allows iam:CreateRole.

Question 6

A company uses AWS Organizations with multiple accounts. They want to centralize VPC flow logs for all VPCs across accounts. The logs should be stored in a central S3 bucket in the management account. What is the MOST efficient way to achieve this?

Accepted Answer

Use a bucket policy on the central S3 bucket to allow cross-account delivery from all accounts.. Option C is correct because you can create a bucket policy in the management account that allows cross-account delivery. Option A is wrong because it requires manual setup. Option B is wrong because CloudWatch Logs is not centralized. Option D is wrong because enabling flow logs on each VPC individually is inefficient.

Answer

Enable VPC flow logs at the organization level using CloudTrail.

Answer

Create a flow log in each account and configure it to deliver to a central S3 bucket.

Answer

Use CloudWatch Logs in each account and stream to a central log group.

Question 7

A company is using AWS Organizations with hundreds of accounts. They need to ensure that no account can modify the VPC default security group. Which SCP should they apply to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroupRules","Resource":"arn:aws:ec2:*:*:security-group/*","Condition":{"StringEquals":{"ec2:Vpc":"arn:aws:ec2:*:*:vpc/*"}}}]}. Option A is correct because it denies the ec2:ModifySecurityGroupRules action on the default security group. Option B is wrong because it denies all security group modifications. Option C is wrong because it denies creation. Option D is wrong because it denies deletion.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:DeleteSecurityGroup","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroup*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateSecurityGroup","Resource":"*"}]}

Question 8

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}. Option B is correct because the condition ec2:CreateAction ensures the tag is applied during launch. Option A is wrong because the condition is on the tag, not on the action. Option C is wrong because it requires a specific value. Option D is wrong because it denies all launches without tag.

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}

Question 9

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

Accepted Answer

Create an IAM role in each target account with a trust policy allowing the management account to assume it.. Option C is correct because it requires an IAM role in the target accounts that StackSets can assume. Option A is wrong because StackSets use roles, not user credentials. Option B is wrong because CloudFormation service role is for stack operations, not cross-account. Option D is wrong because SCPs cannot grant permissions.

Answer

Create IAM users in target accounts with AdministratorAccess.

Answer

Use a CloudFormation service role in the management account.

Answer

Apply an SCP to allow CloudFormation actions across accounts.

Question 10

A company uses AWS Organizations with a policy that denies access to services unless they are explicitly allowed. The security team wants to allow only approved services. What type of policy should they use?

Accepted Answer

Use an SCP with a Deny effect for unapproved services.. Option D is correct because an SCP with a Deny effect for unapproved services is the standard approach. Option A is wrong because Allow lists are not natively supported by SCPs. Option B is wrong because it's the opposite. Option C is wrong because service control policies are for Organizations.

Answer

Use an SCP with an Allow effect for approved services.

Answer

Use an SCP with a Deny effect for all services except approved ones.

Answer

Use an IAM policy with a Deny effect for unapproved services.

Question 11

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

Accepted Answer

An AWS Organizations management account.. Option B is correct because Control Tower requires an AWS Organizations management account. Option A is wrong because it is not required. Option C is wrong because Control Tower sets up a landing zone. Option D is wrong because multiple OUs are created automatically.

Answer

A pre-configured landing zone.

Answer

At least three organizational units (OUs).

Answer

Existing AWS Config rules in all accounts.

Question 12

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

Accepted Answer

Register the member account as a delegated administrator for GuardDuty.. Options B and D are correct. Option A is wrong because GuardDuty does not require an SCP. Option C is wrong because the service must be enabled in the management account. Option E is wrong because the delegated administrator account is a member account, not the management account.

Answer

The delegated administrator must be the management account.

Answer

Create an SCP that allows GuardDuty actions in the member account.

Answer

Enable GuardDuty in all member accounts.

Question 13

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

Accepted Answer

The subnet must be created by the owning account.. Options A, C, and D are correct. Option B is wrong because RAM does not require VPC sharing to be enabled. Option E is wrong because the subnet is shared, not created by the consumer.

Answer

Each consumer account must create a subnet in the same VPC.

Answer

Enable VPC sharing in the AWS Organizations console.

Question 14

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

Accepted Answer

Users can be granted access to multiple accounts from a central location.. Options A and D are correct. Option B is wrong because Identity Center does not use IAM users directly. Option C is wrong because it creates permission sets, not IAM roles in the management account. Option E is wrong because it integrates with Active Directory, but it is not required for all users.

Answer

Users must be IAM users in each account.

Answer

Identity Center requires an on-premises Active Directory.

Answer

Permission sets are assigned to IAM roles in the management account.

Question 15

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to deploy the AWS Config rule across all accounts in the organization.. Option D is correct because AWS CloudFormation StackSets can deploy the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, it applies to new accounts as they are created. Option A is wrong because AWS Config rules are not automatically applied to new accounts unless set up via delegation. Option B is wrong because Service Control Policies (SCPs) control permissions but cannot directly enable AWS Config rules. Option C is wrong because AWS CloudTrail is for logging API calls, not for deploying Config rules.

Answer

Use an SCP in the root to require encryption on S3 buckets.

Answer

Create an AWS Config rule in the management account and delegate an admin account to apply it to all member accounts.

Answer

Configure AWS CloudTrail to automatically enable the AWS Config rule in new accounts.

SAP-C02 Design Solutions for Organizational Complexity Practice Test 5 — 15 Questions

Exhibit

SAP-C02 Design Solutions for Organizational Complexity Practice Test 5 — 15 Questions

Exhibit