SAP-C02 Design Solutions for Organizational Complexity Practice Test 6 — 15 Questions

Question 1

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP only denies future API calls; it does not affect already running instances.. The most likely cause is that the SCP only denies future API calls, not already running instances. SCPs are evaluated at the time of the API request; any instances launched before the SCP was applied or before it was updated to include the deny condition will continue to run unaffected. The security team may be observing those pre-existing disallowed instances, not new launches.

Answer

The SCP has a delay of up to 24 hours before it takes effect.

Answer

The SCP is not attached to the management account.

Answer

The SCP condition is incorrectly formatted; SCPs cannot evaluate instance types.

Question 2

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

Accepted Answer

Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.. The outbound endpoint forwards DNS queries from the workload VPCs to on-premises resolvers, but it does not automatically configure the workload VPCs to use it. A Route 53 Resolver rule must be created in each workload account (or centrally via RAM) to forward queries for the on-premises domain to the outbound endpoint. Without this rule, the workload VPCs will not send queries for on-premises hostnames to the outbound endpoint, so resolution fails.

Answer

Establish VPC peering between the workload VPCs and the networking account VPC.

Answer

Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

Answer

Create a Route 53 Resolver inbound endpoint in the networking account.

Question 3

A company has an AWS Organization with a management account and several member accounts. The management account hosts a central S3 bucket that stores CloudTrail logs from all accounts. The company wants to ensure that only the management account can delete objects from this bucket. Which policy should be applied to the bucket?

Accepted Answer

A bucket policy that denies s3:DeleteObject unless the request is from the management account's root user.. A bucket policy with a Deny effect for s3:DeleteObject that includes a condition key (such as aws:PrincipalArn or aws:username) to allow the action only when the request originates from the management account's root user ensures that only the root user, not any IAM user or role in the management account, can delete objects. This directly enforces the requirement that only the management account's root user can delete objects, as the bucket policy is evaluated for every request to the bucket.

Answer

An SCP that denies s3:DeleteObject for all member accounts.

Answer

An SCP that denies s3:DeleteObject for all accounts except the management account.

Answer

A bucket policy that allows s3:DeleteObject only for the organizational unit containing the management account.

Question 4

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

Accepted Answer

Partition by date and account ID.. Partitioning by date and account ID is most effective because the security team's queries will typically filter by time range and specific accounts. This minimizes data scanned by Athena, which charges per query based on the amount of data read. Partitioning by date first leverages natural time-based access patterns, while account ID further narrows scans when investigating incidents in specific accounts.

Answer

Partition by region and date.

Answer

Partition by account ID only.

Answer

Partition by account ID and region.

Question 5

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Accepted Answer

Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.. Option A is correct because the destination S3 bucket lives in the centralized logging account, so its bucket policy must explicitly grant the member accounts (or their flow log delivery principals) permission to write objects into it, otherwise cross-account delivery is denied. Option C is correct because VPC Flow Logs publishes to S3 through the delivery service principal (delivery.logs.amazonaws.com), so the bucket policy must include a condition/principal allowing that service to call s3:PutObject and s3:GetBucketAcl, which is how AWS validates the flow log destination. Option B is wrong because SCPs only restrict/allow IAM permissions within accounts in the organization and cannot grant a service principal cross-account access to a bucket. Option D is wrong because AWS RAM shares resources like subnets, Transit Gateways, and Route 53 Resolver rules, not S3 buckets, and is not used for flow log delivery. Option E is wrong because an SCP on member accounts is not required to create flow logs and does not grant the destination bucket write access; the bucket policy is what authorizes delivery.

Answer

Attach an SCP to the logging account that allows PutObject to the bucket.

Answer

Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.

Answer

Attach an SCP to the member accounts that allows them to create flow logs.

Question 6

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.. Option A is correct because an SCP attached to the production OU can enforce a guardrail across all accounts in that OU, using a Deny with a condition such as aws:SourceIp (or aws:SourceIp with NotIpAddress) on sts:AssumeRole to block role assumption from outside the corporate range. Option D is correct because the trust policy (AssumeRolePolicyDocument) of each IAM role is where cross-account or principal-based assumption is authorized, and adding a Condition with aws:SourceIp (e.g., IpAddress/NotIpAddress) directly restricts who can assume that role based on the caller's source IP. Option B is not correct because a VPC endpoint for STS only controls access to STS from within a VPC and does not enforce source IP restrictions on role assumption across accounts. Option C is not correct because AWS WAF protects web applications at the HTTP layer and does not govern IAM/STS AssumeRole API calls. Option E is not correct because SCPs are attached to accounts, OUs, or the organization root, not to individual IAM roles, so it cannot be attached to a role.

Answer

Use a VPC endpoint for STS and restrict access to the endpoint.

Answer

Configure AWS WAF to block requests from IPs outside the corporate range.

Answer

Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.

Question 7

A security engineer attaches this SCP to the root organizational unit. What is the result?

Accepted Answer

All IAM users and roles must use MFA for any AWS API call.. Based on the answer choices, the SCP attached to the root OU must be one that denies any AWS API call unless MFA is present. When such an SCP is applied at the root organizational unit, it affects all IAM users and roles across all accounts in the organization, requiring MFA for every API call. Therefore, option C is correct.

Answer

All actions are allowed only if MFA is not used.

Answer

Only the root user is required to use MFA.

Answer

All IAM users must use MFA to access the console, but API calls are not affected.

Question 8

A solutions architect sees this output from the AWS CLI. The management account (111111111111) has a service control policy (SCP) attached that denies all actions unless the request originates from a specific IP range. Which account(s) are affected by this SCP?

Accepted Answer

Only the ProductionAccount (222222222222).. SCPs attached to the management account do not affect the management account itself; they only apply to member accounts. Therefore, the ProductionAccount (222222222222) is the only account affected by this SCP because it is a member account, while the ManagementAccount (111111111111) is exempt from its restrictions.

Answer

Neither account.

Answer

Both accounts.

Answer

The ManagementAccount (111111111111) only.

Question 9

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

Accepted Answer

The launch fails because the SCP denies the action.. The SCP explicitly denies the ec2:RunInstances action for any instance type except t3.micro. Since the user attempts to launch an m5.large, the condition does not match, so the default deny applies, and the launch fails. SCPs are evaluated before IAM policies, and an explicit deny in an SCP overrides any allow.

Answer

The launch succeeds because the condition evaluates to true.

Answer

The launch succeeds because the SCP only denies StartInstances.

Answer

The launch succeeds because the SCP allows all instance types except t3.micro.

Question 10

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

Accepted Answer

Amazon Kinesis Data Firehose delivery stream with cross-account access. Amazon Kinesis Data Firehose can be configured with cross-account access by using a resource-based policy on the delivery stream that grants permissions to other AWS accounts to write log data directly. This allows logs from multiple accounts to be sent to a single Firehose delivery stream in the central account, which then delivers the logs to the OpenSearch Service domain. The cross-account capability is essential for aggregating logs without requiring intermediate storage or complex custom solutions.

Answer

Amazon S3 bucket with cross-account bucket policy

Answer

Amazon CloudWatch Logs subscription filter

Answer

AWS Lambda function in each account that sends logs to a central API

Question 11

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

Accepted Answer

AWS CloudTrail for management events and Amazon S3 server access logs. AWS CloudTrail management events log changes to S3 bucket policies and encryption settings (e.g., PutBucketPolicy, PutBucketEncryption), while S3 server access logs provide detailed object-level access records. Together, they satisfy the security policy's requirements for detecting configuration changes and logging access, without needing additional services.

Answer

Amazon CloudWatch Events and Amazon S3 event notifications

Answer

Amazon CloudWatch Logs and VPC Flow Logs

Answer

AWS Config and AWS CloudTrail

Question 12

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

Accepted Answer

Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions. Service Control Policies (SCPs) can be applied at the organizational unit (OU) or account level to deny the creation of roles with trust policies that allow access from another AWS account unless the trust policy meets specific conditions (e.g., requiring approval or restricting to accounts within the organization). Option B is wrong because IAM policies are account-level and cannot prevent role creation across accounts; they can only control who within an account can create roles, not the content of the trust policy. Option C is wrong because AWS Lambda can automatically delete non-compliant roles after creation, but it cannot prevent the initial creation, which is the requirement. Option D is wrong because AWS Config rules can detect and alert on risky trust policies, but they cannot deny or prevent role creation; they are detective, not preventive.

Answer

Use IAM policies to restrict who can create roles

Answer

Use AWS Lambda to automatically delete non-compliant roles

Answer

Use AWS Config rules to detect and alert on risky trust policies

Question 13

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

Accepted Answer

Use Systems Manager Explorer with multi-account management. Systems Manager Explorer provides a built-in, multi-account view that aggregates operational data (e.g., patch compliance, inventory) from all member accounts in AWS Organizations without requiring custom scripts or manual setup. It leverages AWS Organizations to automatically discover and manage instances across accounts, making it the simplest centralized management solution.

Answer

Use AWS Config to aggregate configuration data

Answer

Use Systems Manager Automation runbooks in each account

Answer

Use CloudFormation StackSets to deploy Systems Manager agents

Question 14

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

Accepted Answer

Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM. Route 53 Resolver outbound endpoints in the central account can forward DNS queries to the central private hosted zones, and the associated Resolver rules can be shared with other accounts via AWS Resource Access Manager (RAM). This provides a centralized, scalable DNS resolution architecture without requiring VPC peering or duplicating hosted zones across accounts.

Answer

Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account

Answer

Create a VPC peering connection between each VPC and the central account's VPC

Answer

Use AWS PrivateLink to connect VPCs to a central DNS service

Question 15

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

Accepted Answer

Use a service control policy (SCP) that denies EC2 RunInstances unless the AMI ID matches the approved list. A service control policy (SCP) can centrally deny the EC2 RunInstances action across all accounts in an AWS Organization unless the request specifies an AMI ID from an approved list. SCPs act as a permission guardrail that cannot be overridden by account-level IAM policies, making them the only mechanism that enforces a mandatory AMI ID across 200 accounts without relying on post-launch detection or per-account configuration.

Answer

Use IAM policies in each account to restrict the AMI ID

Answer

Use AWS Config rules with auto-remediation to stop non-compliant instances

Answer

Use CloudFormation StackSets to enforce AMI IDs for all new instances