SAP-C02 Design Solutions for Organizational Complexity Practice Test 6 — 15 Questions

Question 1

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.. AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs (including member account VPCs and the shared services VPC) in a scalable, managed way. By attaching all VPCs to the Transit Gateway and configuring route tables, you enable private, secure connectivity between member accounts and the central RDS instance without requiring individual VPC peering connections or exposing the database to the internet.

Answer

Use AWS Lambda to proxy database requests from member accounts.

Answer

Make the RDS instance publicly accessible and use IAM authentication.

Answer

Create a VPC peering connection between each member VPC and the shared services VPC.

Question 2

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Accepted Answer

Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.. An AWS Lambda function triggered by CloudTrail events can automatically tag newly created IAM roles with an 'Approved' tag as part of an approval workflow. This ensures that only roles that have gone through the approval process receive the required tag, enabling downstream enforcement via SCPs or AWS Config.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

Answer

Enable AWS CloudTrail to log all IAM role creation events.

Question 3

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Accepted Answer

Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.. Route 53 Resolver outbound endpoints in each VPC forward DNS queries from those VPCs to the central resolver in the shared services VPC, enabling conditional forwarding for private hosted zones. This is the standard mechanism for cross-account DNS resolution when using a central resolver, as it allows each VPC to send queries to a resolver that can access private hosted zones associated with the shared services VPC.

Answer

Route 53 Resolver inbound endpoints in the shared services VPC.

Answer

VPC peering connections between each VPC and the shared services VPC.

Question 4

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

Accepted Answer

The principal should be the CloudTrail service principal, not the root account of 111111111111.. The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Answer

The resource ARN is incorrect.

Answer

The bucket policy requires the x-amz-acl header, which CloudTrail does not set.

Answer

The bucket policy does not allow s3:PutObject for the account 222222222222.

Question 5

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

Accepted Answer

The SCP applies to the production account because it is attached to the root.. SCPs are applied to all accounts in the organization when attached to the root, including the production account. The SCP denying s3:DeleteBucket is an effective deny that overrides any allow in IAM policies, so the production account's administrator cannot delete the bucket regardless of their IAM permissions.

Answer

The production account's IAM policy denies s3:DeleteBucket.

Answer

The SCP only applies to the management account.

Answer

The production account is the management account.

Question 6

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Create an organization trail in the management account with CloudTrail.. AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.

Answer

Enable CloudWatch Logs in each account and stream to a central log group.

Answer

Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.

Answer

Enable S3 server access logs on all accounts and send to a central bucket.

Question 7

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

Accepted Answer

Use AWS Config rules to check AMI IDs against a parameter store and auto-remediate.. AWS Config rules can evaluate EC2 instances against a centrally managed list of approved AMI IDs stored in AWS Systems Manager Parameter Store, and auto-remediate non-compliant instances (e.g., by terminating or stopping them). This approach is scalable across multiple accounts via AWS Config aggregator and cross-account IAM roles, and it is secure because it enforces compliance continuously without relying on client-side IAM policies that can be bypassed.

Answer

Tag approved AMIs and use IAM policies to require that tag.

Answer

Use an IAM policy in each account to allow only specific AMI IDs.

Answer

Use an SCP to deny ec2:RunInstances unless the AMI ID matches an approved list.

Question 8

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

Accepted Answer

Use AWS Organizations with a delegated administrator for IAM.. AWS Organizations allows you to centrally manage multiple accounts and designate a delegated administrator for IAM. This enables the centralized IT team to create and manage IAM roles across all member accounts without granting full administrator access, as the delegated administrator can perform IAM actions within the scope defined by service control policies (SCPs) and IAM permissions.

Answer

Use AWS Single Sign-On with permission sets.

Answer

Create an IAM user in each account with AdministratorAccess.

Answer

Use cross-account roles with a policy that allows iam:CreateRole.

Question 9

A company uses AWS Organizations with multiple accounts. They want to centralize VPC flow logs for all VPCs across accounts. The logs should be stored in a central S3 bucket in the management account. What is the MOST efficient way to achieve this?

Accepted Answer

Use a bucket policy on the central S3 bucket to allow cross-account delivery from all accounts.. A bucket policy on the central S3 bucket can grant the necessary permissions for VPC Flow Logs from any account in the organization to be delivered directly to that bucket. This approach avoids the overhead of managing individual delivery configurations and leverages AWS Organizations to simplify cross-account permissions, making it the most efficient centralized solution.

Answer

Enable VPC flow logs at the organization level using CloudTrail.

Answer

Create a flow log in each account and configure it to deliver to a central S3 bucket.

Answer

Use CloudWatch Logs in each account and stream to a central log group.

Question 10

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}. It uses a Deny effect with a condition that checks if the 'aws:RequestTag/CostCenter' key is null (i.e., not provided). This policy will deny any RunInstances request that does not include the 'CostCenter' tag, effectively requiring the tag to be present at launch. Option A is incorrect because the 'ec2:CreateAction' condition key is unrelated to tag enforcement; it checks the action type, not the presence of a tag. Option B is incorrect because an Allow policy with a condition does not prevent untagged launches if there are other Allow policies (e.g., a broader Allow without conditions). Option D is incorrect because it denies only when the tag is not equal to a specific value 'MyProject', which does not enforce the presence of the tag but rather a specific value.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}

Question 11

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

Accepted Answer

Create an IAM role in each target account with a trust policy allowing the management account to assume it.. AWS CloudFormation StackSets require the management account to assume an IAM role in each target account to deploy resources. This role must have a trust policy that allows the management account's StackSets service-linked role (or a custom role) to assume it, granting the necessary permissions to create, update, or delete stack instances across accounts. Without this cross-account trust relationship, StackSets cannot perform operations in target accounts.

Answer

Create IAM users in target accounts with AdministratorAccess.

Answer

Use a CloudFormation service role in the management account.

Answer

Apply an SCP to allow CloudFormation actions across accounts.

Question 12

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

Accepted Answer

An AWS Organizations management account.. AWS Control Tower requires an AWS Organizations management account because Control Tower uses Organizations to create and manage accounts, apply service control policies (SCPs), and enforce guardrails across the organization. The management account serves as the central point for all administrative actions, and without it, Control Tower cannot establish the necessary multi-account structure or landing zone.

Answer

A pre-configured landing zone.

Answer

At least three organizational units (OUs).

Answer

Existing AWS Config rules in all accounts.

Question 13

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

Accepted Answer

Register the member account as a delegated administrator for GuardDuty.. AWS Organizations allows you to designate a member account as a delegated administrator for GuardDuty, which enables that account to manage GuardDuty across the organization without needing to use the management account. Option C is correct because GuardDuty must be enabled in the management account first to establish the service as the organization-level administrator before you can delegate administration to a member account.

Answer

The delegated administrator must be the management account.

Answer

Create an SCP that allows GuardDuty actions in the member account.

Answer

Enable GuardDuty in all member accounts.

Question 14

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

Accepted Answer

The subnet must be created by the owning account.. AWS Resource Access Manager (RAM) requires the subnet to be created by the owning account. The owning account creates the subnet in its own VPC and then shares it via RAM. Consumer accounts cannot share subnets they did not create; they can only use the shared subnet to launch resources.

Answer

Each consumer account must create a subnet in the same VPC.

Answer

Enable VPC sharing in the AWS Organizations console.

Question 15

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

Accepted Answer

Users can be granted access to multiple accounts from a central location.. AWS IAM Identity Center provides a central location where you can create users and groups, and then grant them single sign-on access to multiple AWS accounts and business applications. This eliminates the need to manage separate IAM users in each account, as permissions are assigned centrally through permission sets that map to IAM roles in the target accounts.

Answer

Users must be IAM users in each account.

Answer

Identity Center requires an on-premises Active Directory.

Answer

Permission sets are assigned to IAM roles in the management account.