SAP-C02 Design Solutions for Organizational Complexity Practice Test 7 — 15 Questions

Question 1

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

Accepted Answer

Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.. Option B is correct because using a Route 53 Resolver outbound endpoint in the central account and associating the private hosted zone with the shared VPC allows cross-account DNS resolution. Option A is wrong because sharing the entire private hosted zone with all accounts is not possible. Option C is wrong because Route 53 inbound endpoints only handle DNS queries from on-premises. Option D is wrong because using Route 53 Resolver rules is part of the correct solution but the zone still needs to be associated with the central VPC.

Answer

Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.

Answer

Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.

Answer

Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.

Question 2

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

Accepted Answer

Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.. Option B is correct because cross-account delivery to a central S3 bucket with S3 Lifecycle policies minimizes storage costs and centralizes logs. Option A is wrong because CloudWatch Logs in each account requires separate retention and is not as cost-effective for long-term storage. Option C is wrong because Kinesis Data Firehose is more expensive and adds complexity. Option D is wrong because S3 replication incurs additional costs.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.

Answer

Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.

Question 3

A company uses AWS Organizations with a multi-account strategy. The security team wants to restrict the use of specific instance types across all accounts. What is the MOST effective way to enforce this policy?

Accepted Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not allowed, and attach it to the root organizational unit.. Option A is correct because SCPs can deny EC2 RunInstances actions with conditions on instance type across all accounts in the organization. Option B is wrong because IAM policies are account-specific and cannot be applied across accounts. Option C is wrong because Config rules only detect non-compliance, they do not enforce. Option D is wrong because Service Control Policies cannot be applied to individual IAM users.

Answer

Create an IAM policy in each account that denies launching non-approved instance types.

Answer

Use AWS Config rules to detect non-compliant instances and trigger an AWS Lambda function to terminate them.

Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances for all users and then attach it to the root OU.

Question 4

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

Accepted Answer

Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.. Option D is correct because a transit gateway with attachment to the inspection VPC (with a firewall appliance) and routing all outbound traffic through it provides centralized inspection. Option A is wrong because VPC peering does not support transitive routing. Option B is wrong because Cloud WAN can be used but it's more complex than needed. Option C is wrong because a central NAT gateway in the security account would require routing all traffic through it, which is less flexible.

Answer

Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

Answer

Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

Answer

Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

Question 5

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

Accepted Answer

Restrict access to the management account and use it only for organization management tasks.. Option C is correct because the management account should have limited access and be reserved for organization management tasks. Option A is wrong because enabling all services in the management account increases risk. Option B is wrong because the management account cannot be used as a payer account if it is also used for production. Option D is wrong because the management account should not be used for development.

Answer

Enable all AWS services in the management account to centrally manage them.

Answer

Use the management account as the payer account and also host production workloads.

Answer

Use the management account for development environments to avoid creating additional accounts.

Question 6

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.. Option B is correct because AWS Resource Access Manager (RAM) allows sharing subnets across accounts with minimal overhead. Option A is wrong because VPC peering does not share subnets. Option C is wrong because Transit Gateway attaches VPCs but does not share subnets. Option D is wrong because creating separate VPCs in each account defeats the purpose of a shared subnet.

Answer

Create a separate VPC in each account and connect them with VPC peering.

Answer

Set up an AWS Transit Gateway and attach the VPCs from each account.

Answer

Create VPC peering connections between the networking account and each workload account.

Question 7

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

Accepted Answer

Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.. Option A is correct because an SCP can deny CloudTrail deletion and disabling, and an S3 bucket policy on the log bucket can prevent log deletion. Option B is wrong because IAM policies in each account are not centralized. Option C is wrong because CloudTrail cannot be protected from deletion by the same account. Option D is wrong because SCP alone cannot protect the S3 bucket.

Answer

Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.

Answer

Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.

Answer

Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.

Question 8

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

Accepted Answer

Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.. Option B is correct because a service control policy can enforce that resources are created with required tags by denying creation if tags are missing. Option A is wrong because tagging resources manually is error-prone. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because AWS Budgets does not enforce tags.

Answer

Use AWS Budgets to alert on untagged resources.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.

Answer

Create an AWS Lambda function that tags resources after they are created.

Question 9

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Accepted Answer

Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.. Options B and D are correct. B: An SCP with a condition on aws:SourceIp restricts access based on IP address across all accounts. D: An S3 bucket policy with a condition on aws:SourceVpce restricts access to specific VPC endpoints. Option A is wrong because it's not centralized. Option C is wrong because it restricts service but not network location. Option E is wrong because it restricts actions but not network.

Answer

Create an IAM policy in each account that denies access unless the request comes from the approved IP range.

Answer

Use AWS PrivateLink to access all AWS services from within the VPC.

Answer

Use AWS Resource Access Manager to share resources with approved accounts only.

Question 10

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Accepted Answer

Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.. Options A, C, and D are correct. A: Enable GuardDuty in the security account and designate it as the administrator for all member accounts. C: Enable Security Hub in the security account and use the integration to aggregate findings. D: Enable IAM Access Analyzer in the security account with the organization as the zone of trust. Option B is wrong because GuardDuty is region-specific and cannot be centralized in one region. Option E is wrong because Config aggregator aggregates configuration items, not security findings.

Answer

Use AWS Config aggregator in the security account to collect configuration items from all accounts.

Answer

Configure GuardDuty in the security account to monitor all regions by using a single detector.

Question 11

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Accepted Answer

Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.. Options A and C are correct. A: A service role with the necessary permissions must be created in each account. C: A maintenance window in the management account can target instances in member accounts using resource groups. Option B is wrong because the SSM agent does not need to be replaced. Option D is wrong because instance profiles are not automatically created. Option E is wrong because Systems Manager does not use AWS Config for patching.

Answer

Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

Answer

Enable AWS Config in all accounts to track patch compliance.

Answer

Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

Question 12

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

Accepted Answer

The EC2 instance launch will be denied because the SCP denies actions in regions not listed.. Option B is correct. The SCP denies EC2 actions in all regions except us-east-1 and eu-west-1. Since ap-southeast-1 is not in the allowed list, the action will be denied. Option A is wrong because the SCP explicitly denies. Option C is wrong because SCPs apply to all IAM principals. Option D is wrong because there is no explicit allow; the default is allow but this deny overrides.

Answer

The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

Answer

The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

Answer

The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

Question 13

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

Accepted Answer

The workload account must configure security groups for the EC2 instance to allow traffic to the RDS database's security group.. Option C is correct. When a subnet is shared, the owner account manages the route tables and network ACLs, but the participant account cannot modify them. However, the participant account can use security groups to control traffic to/from its instances. Therefore, the workload account must configure security groups to allow traffic between the EC2 instance and the RDS database. Option A is wrong because VPC peering is not needed; the VPC is already shared. Option B is wrong because the route table is managed by the owner, not the participant. Option D is wrong because transit gateway is not needed.

Answer

The workload account must create a route table entry in the shared VPC to allow communication.

Answer

Establish a VPC peering connection between the workload account's VPC and the shared VPC.

Answer

Attach an AWS Transit Gateway to both VPCs to enable communication.

Question 14

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

Accepted Answer

The bucket policy only grants access to the root user of account 123456789012, not to other accounts.. Option C is correct. The bucket policy grants access only to the root user of account 123456789012 (the bucket owner account), not to other accounts. The developer's account (111111111111) is not authorized. Option A is wrong because secure transport is required, but the request likely uses HTTPS. Option B is wrong because signed requests are used. Option D is wrong because the bucket policy explicitly allows access, but only to the specified principal.

Answer

The bucket policy denies access from all accounts except 123456789012.

Answer

The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.

Answer

The request is not signed, so it is denied by the aws:SecureTransport condition.

Question 15

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

Accepted Answer

Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.. Option C is correct because it uses a Service Control Policy (SCP) to deny creation of buckets without SSE-KMS, and a Config rule with auto-remediation via Lambda to fix existing non-compliant buckets. Option A is wrong because SCPs cannot remediate existing buckets. Option B is wrong because CloudTrail is for logging, not enforcement. Option D is wrong because Resource Access Manager (RAM) does not enforce encryption.

Answer

Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.

Answer

Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.

Answer

Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.