SAP-C02 Design Solutions for Organizational Complexity Practice Test 7 — 15 Questions

Question 1

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets with automatic deployment to deploy the AWS Config rule across all accounts in the organization.. AWS CloudFormation StackSets with automatic deployment can deploy the AWS Config rule across all accounts in an AWS Organization, including newly created member accounts, by targeting the root organizational unit (OU). This ensures that the Config rule is automatically enabled in new accounts as they are created, meeting the security team's requirement without manual intervention.

Answer

Use an SCP in the root to require encryption on S3 buckets.

Answer

Create an AWS Config rule in the management account and delegate an admin account to apply it to all member accounts.

Answer

Configure AWS CloudTrail to automatically enable the AWS Config rule in new accounts.

Question 2

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

Accepted Answer

Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.. CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

Answer

Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.

Answer

Configure the bucket ACL to allow write access for all member account root users.

Answer

Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.

Question 3

A company uses AWS Organizations with a hierarchical OU structure. The security OU has an SCP that denies all actions except those explicitly allowed. The development OU has an SCP that allows all actions. A developer account in the development OU tries to launch an EC2 instance but receives an access denied error. The IAM user in the developer account has full administrator permissions. What is the most likely cause?

Accepted Answer

An SCP at the root level denies EC2 actions.. The most likely cause is an SCP at the root level that denies EC2 actions. In AWS Organizations, SCPs are evaluated hierarchically: an explicit deny at the root level overrides any allow from a lower-level OU or account-level policy. Even though the development OU has an SCP that allows all actions, the root-level SCP (which denies all actions except those explicitly allowed) will block EC2 actions unless EC2 is explicitly allowed in that root SCP. The IAM user's full administrator permissions are irrelevant because SCPs act as a permission boundary that cannot be bypassed by account-level IAM policies.

Answer

The SCP at the development OU level denies EC2 actions.

Answer

The IAM user does not have MFA enabled, and an SCP requires MFA.

Answer

An SCP at the root level requires encryption on EC2 instances, which is not satisfied.

Question 4

A company is using AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have a specific AWS Config rule enabled and that any drift is automatically remediated. Which approach should be used?

Accepted Answer

Use AWS Control Tower lifecycle events and customizations to deploy the Config rule and set up automatic remediation.. AWS Control Tower provides lifecycle events and customizations (via AWS Control Tower Lifecycle Events and Customizations for AWS Control Tower) that allow you to automatically deploy and remediate AWS Config rules across all accounts in the organization. This approach ensures that the Config rule is applied consistently when new accounts are created or when drift is detected, meeting the security team's requirement for automatic remediation without manual intervention.

Answer

Use EC2 Auto Scaling to apply the Config rule to all accounts.

Answer

Use AWS CloudTrail to monitor for accounts without the Config rule and trigger a Lambda function to add it.

Answer

Use AWS Config to create a conformance pack that applies the rule, and use an SCP to require it.

Question 5

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

Accepted Answer

Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.. It uses a cross-account destination in the logging account with subscription filters in the source accounts, which is the standard pattern for streaming CloudWatch Logs across accounts. The KMS key policy must grant the CloudWatch Logs service in the source accounts permission to use the key (via kms:Encrypt and kms:Decrypt) so that logs can be encrypted at rest in the logging account while only the logging account manages the key.

Answer

Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.

Answer

Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.

Answer

Use the default AWS-managed KMS key for CloudWatch Logs in each source account.

Question 6

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 7

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the transit gateway with authorized accounts.. AWS Resource Access Manager (RAM) allows the network account to share the transit gateway with specific application accounts, enabling them to create attachments without granting them ownership or management of the transit gateway itself. This approach ensures that only authorized accounts can create VPC attachments to the shared transit gateway, as the sharing is controlled at the resource level and can be revoked at any time.

Answer

Use AWS Direct Connect to connect each application account to the transit gateway.

Answer

Establish VPC peering connections between each application account and the network account.

Answer

Create an SCP that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account.

Question 8

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

Accepted Answer

Use AWS SSO to assign the finance group to the finance OU accounts only.. AWS SSO (now AWS IAM Identity Center) allows you to assign users or groups to specific AWS accounts and OUs directly. By assigning the finance group only to the finance OU accounts, you enforce that those users can only access those accounts via the SSO portal, without needing additional SAML attributes or SCPs. This is the simplest and most direct method for controlling account access based on group membership.

Answer

Configure the external IdP to send a SAML attribute that AWS uses to enforce permissions.

Answer

Create an SCP that denies access to non-finance accounts for users from the finance group.

Answer

Create IAM roles in each finance account and trust the IdP with a condition on the group attribute.

Question 9

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

Accepted Answer

Use tag policies in AWS Organizations to enforce required tags on resources.. Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.

Answer

Define cost allocation tags in the management account and activate them for all accounts.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Use an SCP that denies resource creation if the required tags are not present.

Question 10

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.. A CloudWatch Logs metric filter can parse CloudTrail logs for specific API calls (e.g., CreateRole, UpdateAssumeRolePolicy) and trigger an alarm when IAM role creation or modification events occur. Option D is correct because enabling CloudTrail management events with CloudWatch Logs integration in all accounts ensures that all IAM role API calls are captured in a centralized log group, which is a prerequisite for the metric filter and alarm to work.

Answer

Use AWS Config to record IAM role changes and stream to CloudWatch Logs.

Answer

Create an SCP that denies IAM role creation and modification.

Answer

Enable IAM Access Analyzer to monitor IAM role usage.

Question 11

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

Accepted Answer

Add a bucket policy on the central S3 bucket that grants the service principal 'delivery.logs.amazonaws.com' s3:PutObject permission.. The S3 bucket policy must grant the `delivery.logs.amazonaws.com` service principal the `s3:PutObject` permission. This allows the VPC Flow Logs delivery service, which runs in the member accounts, to write log data directly into the central S3 bucket in the logging account without requiring cross-account IAM roles or temporary credentials.

Answer

Create an IAM role in the logging account that the member accounts can assume to put objects.

Answer

Create an S3 bucket in each member account to receive Flow Logs, and replicate to the central bucket.

Answer

Enable AWS CloudTrail in the management account to aggregate logs.

Question 12

Refer to the exhibit. A company applies this S3 bucket policy to a central logging bucket. CloudTrail trails in multiple accounts are configured to deliver logs to this bucket. Recently, logs stopped being delivered. What is the most likely cause?

Accepted Answer

CloudTrail does not automatically set the 'bucket-owner-full-control' ACL when delivering logs.. When CloudTrail delivers logs to an S3 bucket owned by a different account, it does not automatically set the 'bucket-owner-full-control' ACL on the delivered objects. Without this ACL, the bucket owner (the central logging account) does not have full control over the objects, and the bucket policy's Deny statement (which requires s3:GetObjectAcl and s3:PutObjectAcl for bucket-owner-full-control) will block access, causing log delivery to fail. The solution is to configure CloudTrail to apply the 'bucket-owner-full-control' canned ACL or modify the bucket policy to grant the bucket owner full control via a different mechanism.

Answer

The Principal element uses 'cloudtrail.amazonaws.com' which is not the correct service principal.

Answer

The Resource ARN does not include the account ID, so it matches all accounts.

Answer

The policy uses 'Deny' which is not allowed in S3 bucket policies.

Question 13

Refer to the exhibit. A company runs this CLI command and sees the output. Which account is the management account?

Accepted Answer

111111111111. The management account in AWS Organizations is the account that created the organization and has the ID displayed in the `management-account-id` field of the `aws organizations describe-organization` output. In the exhibit, this field shows `111111111111`, making option D correct.

Answer

333333333333

Answer

222222222222

Answer

o-example1

Question 14

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

Accepted Answer

All principals outside the organization are denied all actions.. The SCP explicitly denies all actions (`ec2:*`, `s3:*`, etc.) to any principal outside the organization by using a `Condition` block with `aws:PrincipalOrgID` set to the organization's ID. This effectively blocks any request from an IAM user, role, or federated principal that is not a member of the specified AWS Organization. The `Deny` effect overrides any allow, so all actions are denied for external principals.

Answer

All principals are required to have MFA enabled.

Answer

All principals in the organization are allowed all actions.

Answer

All principals in the organization are denied all actions.

Question 15

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

Accepted Answer

Create an SCP to deny disabling AWS Config, and use an AWS Config conformance pack in a delegated admin account to enforce rules across the organization.. It combines an SCP to prevent disabling AWS Config with an AWS Config conformance pack deployed from a delegated admin account, which automatically applies to all existing and new member accounts in the organization. This approach is fully automated, requires no manual intervention for new accounts, and enforces both the enablement of Config and the required rules across the entire organization.

Answer

Create an AWS Config aggregator in the management account and enable Config for each account manually.

Answer

Use AWS CloudFormation StackSets to deploy a Config template to each account, and manually add new accounts to the StackSet.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail to enable Config and deploy rules whenever a new account is created.