SAP-C02 Design Solutions for Organizational Complexity Practice Test 7 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation. Option C is correct because AWS Config rules can continuously evaluate whether CloudTrail is properly configured (for example, using the managed rule cloud-trail-enabled) and, combined with remediation actions via SSM Automation documents, automatically re-enable or fix the trail, giving detective plus corrective enforcement across accounts. Option E is correct because an SCP attached at the organization or OU level can explicitly deny CloudTrail-disabling and trail-modifying API calls such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail, providing preventive guardrails that apply to all member accounts. Option A is incorrect because an IAM role by itself cannot force CloudTrail to be enabled; roles grant permissions but do not enforce service configuration. Option B is incorrect because CloudFormation StackSets deploy a trail but do not prevent someone from later disabling or altering it, so they are not an enforcement mechanism. Option D is incorrect because a custom Lambda to re-enable CloudTrail is a reactive workaround that lacks the preventive control of an SCP and the managed detection/remediation of AWS Config, and it would not stop the disabling action in the first place.

Answer

Create an IAM role in each account that requires CloudTrail to be enabled

Answer

Use CloudFormation StackSets to deploy a CloudTrail trail in each account

Answer

Use AWS Lambda to automatically re-enable CloudTrail if it is disabled

Question 2

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Accepted Answer

AWS Organizations. AWS Organizations (A) is correct because it provides the multi-account governance foundation, enabling consolidated management of all accounts in the organization so that policies such as service control policies (SCPs) can be applied centrally to restrict IAM permissions across every member account. AWS IAM Access Analyzer (C) is correct because it analyzes resource-based policies and IAM policies to identify resources shared with external entities or unused permissions, giving the security team centralized findings to audit and refine IAM permissions. AWS CloudTrail (D) is correct because it records API activity across all accounts, and when combined with an organization trail delivering logs to a central security account, it provides the audit trail needed to review IAM-related actions centrally. AWS Config (B) is not among the marked answers because, while it tracks resource configuration changes and compliance, it is not one of the three services specified for centrally managing and auditing IAM permissions in this scenario. Amazon GuardDuty (E) is not marked because it is a threat-detection service that identifies malicious activity and compromised credentials, not a tool for centrally managing or auditing IAM permissions.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Accepted Answer

Permission sets that define the level of access to each account. AWS Single Sign-On requires an identity source and permission sets. The identity source can be the built-in identity store or an external identity provider (IdP). Therefore, an external IdP is not strictly required. From the given options, only permission sets (E) are a required component.

Answer

AWS Cloud Directory

Answer

A service control policy (SCP) attached to the root

Answer

An IAM user in each account

Answer

An external identity provider (IdP) such as Azure AD or Okta

Question 4

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

Accepted Answer

The SCP is not attached to the correct OU or root. The most likely reason is that the SCP is not attached to the correct OU or root. SCPs must be explicitly attached to the target OU, account, or root to take effect. If the SCP is attached to a different OU or not attached at all, it will not restrict the accounts in the intended OU, allowing users to launch any instance type.

Answer

The SCP syntax is invalid because it uses StringNotEquals

Answer

The SCP must also allow the allowed instance types in a separate statement

Answer

The SCP does not include an Allow statement for the allowed instance types

Question 5

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

Accepted Answer

The trust policy only allows the root user, not individual users. The trust policy explicitly allows only the root user of account 111111111111 (arn:aws:iam::111111111111:root) to assume the role. Individual IAM users within that account are not granted permission unless the trust policy includes the specific user ARN or a condition that allows federated access. Since the user is not the root user, the sts:AssumeRole call fails due to the principal restriction in the trust policy.

Answer

A service control policy in account 222222222222 is denying the sts:AssumeRole action

Answer

The role is not in the same region as the user

Answer

The trust policy is malformed

Question 6

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.. A Service Control Policy (SCP) applied at the root or organizational unit (OU) level in AWS Organizations can centrally deny all AWS API actions for any principal that does not have a multi-factor authentication (MFA) device associated with the session. This enforces MFA across all member accounts without requiring individual account-level IAM policy changes, making it the most efficient and scalable solution for the security team's requirement.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.

Answer

Create an IAM policy in each account that denies access without MFA.

Question 7

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

Accepted Answer

Create a cross-region read replica in the central account and grant access to other accounts.. Creating a cross-region read replica in the central account and granting access to other accounts allows each account to have a local read replica that stays in sync with the source, providing high availability and disaster recovery while minimizing cross-region data transfer costs (since replicas are in the same region as the source? Actually, the replica is cross-region, so costs are incurred, but among the given options, this is the only one that uses actual read replicas for continuous replication. Option C is wrong because restoring a snapshot creates an independent instance that does not automatically sync with the source, so it does not meet the requirement for continuous replication and disaster recovery.

Answer

Use a VPC endpoint to share the database across accounts without data transfer costs.

Answer

Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.

Answer

Create an IAM role in each account to access the central RDS instance directly.

Question 8

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

Accepted Answer

Nothing, shared subnets are automatically available to all accounts in the organization.. When AWS Organizations is configured with all features enabled and sharing is enabled within the organization, Resource Access Manager (RAM) automatically shares resources with all accounts in the organization without requiring individual acceptance. Therefore, shared subnets are immediately available to member accounts for launching resources, and no additional action is needed in the member accounts.

Answer

The member account must create an IAM role to assume for launching resources in the shared subnet.

Answer

The member account must create a VPC and then associate the shared subnet.

Answer

The member account must accept the resource share invitation.

Question 9

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

Accepted Answer

Use AWS Systems Manager Quick Setup to configure patching across accounts.. AWS Systems Manager Quick Setup is the most efficient way to centrally configure patching across multiple AWS accounts because it automates the deployment of SSM Patch Manager resources, including patch baselines, maintenance windows, and IAM roles, across accounts in an AWS Organization. It eliminates the need to manually set up patching in each account, providing a single-pane-of-glass management experience from the management account.

Answer

Use AWS Systems Manager Patch Manager in the management account.

Answer

Use AWS Systems Manager Automation documents in each account.

Answer

Use AWS Config rules to trigger patching in each account.

Question 10

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

Accepted Answer

Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.. An SCP (Service Control Policy) that denies `iam:CreateRole` unless the role has the required trust policy is the most scalable enforcement mechanism. SCPs are applied at the organizational unit (OU) or account level in AWS Organizations, allowing the central security team to centrally prevent the creation of non-compliant IAM roles across all business unit accounts without requiring per-account configuration or manual intervention. This approach enforces compliance proactively (preventive control) rather than reactively (detective control), and it scales automatically as new accounts are added to the organization.

Answer

Use AWS Config rules to detect non-compliant roles and send alerts.

Answer

Deploy the IAM roles using AWS CloudFormation StackSets.

Answer

Request each business unit to create the required IAM roles manually.

Question 11

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

Accepted Answer

Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.. AWS Organizations tag policies allow you to define rules for tagging resources across all accounts in the organization, including enforcement of required tags like 'CostCenter'. Tag policies are evaluated at resource creation and can prevent non-compliant resources from being created, ensuring consistent cost allocation tagging without requiring individual account-level IAM changes.

Answer

Create an IAM policy in each account that requires the CostCenter tag.

Answer

Use AWS Config rules to identify untagged resources and automatically tag them.

Answer

Use an SCP to deny resource creation if the CostCenter tag is missing.

Question 12

A company is designing a multi-account AWS environment with a centralized logging account. Which TWO services should be used to aggregate logs from all accounts?

Accepted Answer

AWS CloudTrail with cross-account S3 bucket. Option A is correct because AWS CloudTrail can be configured as an organization trail that delivers events from every account in the AWS Organization to a single S3 bucket in the centralized logging account, using a bucket policy that grants the CloudTrail service principal cross-account write access. Option B is correct because CloudWatch Logs supports cross-account subscription filters, allowing log groups in member accounts to stream log events to a destination (such as a Kinesis Data Streams or Lambda) in the centralized logging account for aggregation. Option C is not correct because S3 cross-region replication only copies objects between buckets in different regions and does not itself aggregate logs from multiple accounts. Option D is not correct because VPC Flow Logs is a source of network log data, not an aggregation mechanism across accounts. Option E is not correct because Kinesis Data Firehose is a delivery service for streaming data to destinations, not a cross-account log aggregation service on its own.

Answer

Amazon S3 cross-region replication

Answer

Amazon VPC Flow Logs

Answer

Amazon Kinesis Data Firehose

Question 13

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

Accepted Answer

Configure S3 buckets in each account to use the shared KMS key for server-side encryption.. Option B is correct because each S3 bucket must be configured to use the shared customer managed KMS key for server-side encryption (SSE-KMS), which is what actually encrypts the data at rest with the centralized key. Option C is correct because a customer managed KMS key created in the security account must be shared with the other accounts via AWS Resource Access Manager (RAM) or a KMS key policy so those accounts can use it for encryption. Option E is correct because an SCP denying s3:PutObject unless the request specifies the required KMS key enforces the encryption requirement at the AWS Organizations level, preventing unencrypted uploads. Option A is not among the correct answers because a bucket policy alone cannot enforce SSE-KMS encryption in the way required here. Option D is not correct because creating IAM users in the security account does not grant the other accounts' principals access to the KMS key or configure encryption on their S3 buckets.

Answer

Configure S3 bucket policies in each account to enforce encryption using the KMS key.

Answer

Create IAM users in the security account and grant them access to the KMS key.

Question 14

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Accepted Answer

Create a centralized S3 bucket in the logging account.. Option B is correct because a centralized S3 bucket in a dedicated logging account is the standard AWS Organizations pattern for aggregating VPC flow logs from all accounts, with each account's flow log delivery configured to publish to that bucket (using the appropriate bucket policy and, for log delivery, the aws:SourceArn/aws:SourceAccount conditions). Option D is correct because an SCP applied at the organization or OU level is the mechanism that enforces the requirement across all accounts, ensuring member accounts cannot disable or omit VPC flow logs and must create them with the approved destination. Option A is not required because cross-account CloudWatch Logs subscriptions are for streaming log events between accounts, not the primary mechanism for centrally managing VPC flow logs at organization scale. Option C is not required because Kinesis Data Firehose is an optional delivery/transformation path, not a mandatory step for centralized flow log management. Option E is not required because AWS Config rules can detect and remediate noncompliance, but they do not by themselves enable flow logs across all accounts as the required organizational control.

Answer

Configure cross-account CloudWatch Logs subscription.

Answer

Use VPC Flow Logs with Amazon Kinesis Data Firehose.

Answer

Use AWS Config rules to enable flow logs automatically.

Question 15

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.. SCPs are the native AWS Organizations mechanism for centrally enforcing permission guardrails across many accounts. Attaching the SCP to the OU that contains all accounts applies the deny-based policy to every member account at once, so any attempt to create an unencrypted bucket or a bucket policy allowing HTTP is blocked at the API level. This is the most efficient approach because it is a single, centralized control that scales automatically as accounts are added to the OU.

Answer

Apply a service control policy (SCP) to the management account.

Answer

Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

Answer

Use AWS Config rules with automatic remediation in each account.