SAP-C02 Design Solutions for Organizational Complexity Practice Test 8 — 15 Questions

Question 1

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.. It uses Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account's private hosted zone, enabling centralized management of DNS records across accounts. This approach provides high availability and supports cross-account DNS resolution.

Answer

Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.

Answer

Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.

Answer

Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.

Question 2

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

Accepted Answer

Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.. Delivering logs from all accounts to a central Amazon S3 bucket in a logging account is the most scalable and cost-effective approach. S3 Lifecycle policies can automatically transition older logs to Amazon S3 Glacier, reducing storage costs while retaining data for compliance. This design avoids cross-account data transfer fees and minimizes operational overhead by using a single bucket with centralized access controls.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.

Answer

Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.

Question 3

A company uses AWS Organizations with a multi-account strategy. The security team wants to restrict the use of specific instance types across all accounts. What is the MOST effective way to enforce this policy?

Accepted Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not allowed, and attach it to the root organizational unit.. A Service Control Policy (SCP) attached to the root organizational unit (OU) can centrally deny the ec2:RunInstances action for non-approved instance types across all member accounts without requiring per-account configuration. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users in the affected accounts, making them the most effective mechanism for enforcing organization-wide restrictions on instance types.

Answer

Create an IAM policy in each account that denies launching non-approved instance types.

Answer

Use AWS Config rules to detect non-compliant instances and trigger an AWS Lambda function to terminate them.

Answer

Create a Service Control Policy (SCP) that denies ec2:RunInstances for all users and then attach it to the root OU.

Question 4

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

Accepted Answer

Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.. A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.

Answer

Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

Answer

Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

Answer

Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

Question 5

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

Accepted Answer

Restrict access to the management account and use it only for organization management tasks.. The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.

Answer

Enable all AWS services in the management account to centrally manage them.

Answer

Use the management account as the payer account and also host production workloads.

Answer

Use the management account for development environments to avoid creating additional accounts.

Question 6

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.. AWS Resource Access Manager (RAM) allows you to share a subnet from a central VPC in the networking account with other AWS accounts without creating separate VPCs or complex networking. This enables workload accounts to launch resources directly into the shared subnet, achieving low latency by keeping them in the same VPC and Availability Zone. RAM handles the cross-account sharing with minimal operational overhead, as it does not require additional network appliances or routing configuration.

Answer

Create a separate VPC in each account and connect them with VPC peering.

Answer

Set up an AWS Transit Gateway and attach the VPCs from each account.

Answer

Create VPC peering connections between the networking account and each workload account.

Question 7

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

Accepted Answer

Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.. It combines an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket with a bucket policy that denies s3:DeleteObject for all principals except the management account. This layered approach ensures that even if an account has full administrative permissions, the SCP blocks the CloudTrail and S3 actions, while the bucket policy prevents any account (including the root user) from deleting log files, with the management account as the sole exception for recovery purposes.

Answer

Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.

Answer

Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.

Answer

Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.

Question 8

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

Accepted Answer

Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.. A service control policy (SCP) can be applied at the root, OU, or account level in AWS Organizations to deny the creation of resources that do not have the required cost allocation tags. This enforces tagging proactively at the API call level, preventing untagged resources from being created in the first place, which is the most effective approach for central enforcement.

Answer

Use AWS Budgets to alert on untagged resources.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.

Answer

Create an AWS Lambda function that tags resources after they are created.

Question 9

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Accepted Answer

Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.. An S3 bucket policy with the `aws:SourceVpce` condition key restricts access to only requests originating from a specific VPC endpoint, ensuring data can only be accessed from approved network locations within the VPC. Option D is correct because a service control policy (SCP) that denies access unless the request originates from an approved IP address range enforces a data perimeter across all accounts in the AWS Organization, preventing access from unapproved networks.

Answer

Create an IAM policy in each account that denies access unless the request comes from the approved IP range.

Answer

Use AWS PrivateLink to access all AWS services from within the VPC.

Answer

Use AWS Resource Access Manager to share resources with approved accounts only.

Question 10

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Accepted Answer

Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.. AWS Security Hub supports multi-account management by designating a central administrator account (the security account) that aggregates findings from all member accounts across the organization. This is done through AWS Organizations integration, enabling automatic enrollment of all accounts and regions without manual setup.

Answer

Use AWS Config aggregator in the security account to collect configuration items from all accounts.

Answer

Configure GuardDuty in the security account to monitor all regions by using a single detector.

Question 11

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Accepted Answer

Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.. Systems Manager requires an IAM service role in each member account to delegate permissions from the management account; the AmazonSSMManagedInstanceCore policy provides the minimum necessary permissions for SSM Agent to communicate with the Systems Manager service. Option E is correct because a maintenance window created in the management account can target instances across multiple accounts using AWS Resource Groups that are configured with cross-account resource queries, enabling centralized patch management without logging into each account.

Answer

Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

Answer

Enable AWS Config in all accounts to track patch compliance.

Answer

Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

Question 12

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

Accepted Answer

The EC2 instance launch will be denied because the SCP denies actions in regions not listed.. SCPs are evaluated using a deny-by-default model where any action not explicitly allowed is implicitly denied. The SCP in question denies all EC2 actions in any region not listed in the allow list (us-east-1 and eu-west-1). Since ap-southeast-1 is not in that list, the EC2 launch is denied regardless of any IAM permissions the developer may have.

Answer

The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

Answer

The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

Answer

The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

Question 13

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

Accepted Answer

The workload account must configure security groups for the EC2 instance to allow traffic to the RDS database's security group.. When an EC2 instance is launched into a shared subnet via AWS RAM, the workload account can manage its own security groups, but the underlying VPC and its route tables remain under the management of the VPC owner. Since the instance and the RDS database are in the same VPC, no inter-VPC connectivity (like VPC peering or Transit Gateway) is needed. The only missing piece is that the workload account must configure its EC2 instance's security group to allow outbound traffic to the RDS database's security group, and the RDS database's security group must allow inbound traffic from the EC2 instance's security group, both of which are standard security group rules within the same VPC.

Answer

The workload account must create a route table entry in the shared VPC to allow communication.

Answer

Establish a VPC peering connection between the workload account's VPC and the shared VPC.

Answer

Attach an AWS Transit Gateway to both VPCs to enable communication.

Question 14

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

Accepted Answer

The bucket policy only grants access to the root user of account 123456789012, not to other accounts.. The bucket policy in the exhibit uses a Principal element of `"AWS": "arn:aws:iam::123456789012:root"`. This grants access only to the root user of account 123456789012, not to any IAM users or roles in that account, and certainly not to any principals in account 111111111111. When the developer from account 111111111111 attempts to access the object with a signed request (no --no-sign-request), the request is signed with credentials from that account, which are not listed in the Principal, so S3 denies the request.

Answer

The bucket policy denies access from all accounts except 123456789012.

Answer

The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.

Answer

The request is not signed, so it is denied by the aws:SecureTransport condition.

Question 15

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

Accepted Answer

Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.. It combines a Service Control Policy (SCP) to proactively deny any PutBucketEncryption action that does not specify SSE-KMS, preventing non-compliant buckets from being created, and AWS Config with a custom rule and automatic remediation via Lambda to detect and fix existing non-compliant buckets. This dual approach ensures both prevention and remediation across all accounts in the AWS Organization, meeting the security team's enforcement requirement.

Answer

Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.

Answer

Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.

Answer

Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.