SAP-C02 Design Solutions for Organizational Complexity Practice Test 8 — 15 Questions

Question 1

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An SCP that denies ec2:RunInstances when the instance type is not t2.micro.. An SCP that denies ec2:RunInstances when the instance type is not t2.micro is correct because SCPs are the AWS Organizations mechanism for setting maximum permissions across accounts in an OU, and a Deny with a condition on ec2:InstanceType enforces the restriction centrally. The deny-based approach is preferred because it blocks all other instance types while allowing t2.micro, and it cannot be overridden by account-level IAM policies.

Answer

An IAM policy applied to each account's admin role to restrict instance types.

Answer

An SCP that allows ec2:RunInstances only for t2.micro.

Answer

An AWS Config rule to terminate non-compliant instances.

Question 2

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with MySQL compatibility.. Amazon Aurora Global Database with MySQL compatibility is designed for cross-Region disaster recovery with a Recovery Time Objective (RTO) of less than 1 minute and minimal data loss (typically sub-second). It uses storage-based replication that is asynchronous but with very low latency, and it supports a managed failover process that promotes a secondary Region to primary in under a minute, meeting the strict RTO requirement.

Answer

Use cross-Region Read Replicas with automatic failover.

Answer

Use a Multi-AZ RDS instance with a standby in another Region.

Answer

Use AWS Database Migration Service for continuous replication.

Question 3

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

Accepted Answer

Configure an SQS dead-letter queue for failed messages.. An SQS dead-letter queue (DLQ) captures messages that cannot be processed successfully after the maximum retries are exhausted, preventing event loss during traffic spikes. This ensures that failed messages are preserved for later analysis or reprocessing, which is critical for reliability in a serverless event-driven architecture.

Answer

Increase the SQS visibility timeout to 30 minutes.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Set Lambda reserved concurrency to a low value to control costs.

Question 4

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account log groups.. Amazon CloudWatch Logs supports cross-account log data sharing through subscription filters and destination log groups, allowing log events from multiple accounts to be aggregated into a single centralized log group, which is why option A is correct. Amazon S3 can serve as a centralized logging repository by configuring a single bucket with bucket policies and cross-account access (often combined with CloudTrail or service log delivery), enabling logs from many accounts to land in one place, which is why option C is correct. Amazon SQS is a message queue, not a log aggregation or storage service, so option B does not implement centralized logging. AWS CloudFormation is an infrastructure-as-code provisioning service and does not itself collect or centralize logs, so option D is not appropriate. Amazon Kinesis Data Firehose is a streaming delivery service that can forward data to destinations, but it is not a centralized logging solution on its own and is not marked correct here, so option E does not belong.

Answer

Amazon SQS.

Answer

AWS CloudFormation.

Answer

Amazon Kinesis Data Firehose.

Question 5

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.. An SCP applied to the root OU is the most efficient way to enforce a blanket denial of public access to S3 buckets across all accounts in AWS Organizations. It prevents any account, including root users, from performing the s3:PutBucketPublicAccessBlock action, ensuring compliance without per-account configuration or remediation.

Answer

Use AWS Config rules to detect and remediate public buckets in each account.

Answer

Create a CloudFormation StackSet to deploy bucket policies in every account.

Answer

Use IAM roles to restrict users from modifying bucket public access settings.

Question 6

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

Accepted Answer

Apply an SCP that allows EC2 actions only in the allowed Regions.. Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.

Answer

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Answer

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Answer

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Question 7

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

Accepted Answer

Apply an SCP that denies ec2:RunInstances unless the request includes the CostCenter tag.. An SCP that denies ec2:RunInstances unless the request includes the CostCenter tag enforces tag propagation at the point of resource creation. This is a preventive control that blocks non-compliant actions before they happen, ensuring all EC2 instances are tagged from the start. It leverages AWS Organizations to apply the policy across all accounts in the specified OUs, providing centralized enforcement without relying on post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on provisioned products.

Answer

Run a Lambda function that tags resources after creation based on the creator's cost center.

Answer

Use AWS Config rules to mark non-compliant resources and auto-remediate.

Question 8

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

Accepted Answer

Create an IAM policy that denies EC2 actions unless the region is us-east-1.. An IAM policy with a Deny effect for ec2:RunInstances when the region is not us-east-1 directly prevents developers from launching EC2 instances in any other region. This is the simplest approach as it uses native IAM condition keys (aws:RequestedRegion) without requiring additional services or complex configurations.

Answer

Use AWS Config to terminate instances in other Regions.

Answer

Apply an SCP to the account.

Answer

Configure the default VPC in us-east-1 only.

Question 9

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

Accepted Answer

Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.. An SCP applied at the root or OU level can deny ec2:RunInstances unless the ec2:ImageId matches a specific set of allowed AMIs. This scales to 500 accounts without per-account configuration, as SCPs are inherited by all accounts in the organization. The condition key ec2:ImageId supports wildcard patterns or a list of AMI IDs, making it a centralized, preventive control.

Answer

Use AWS Config to detect non-compliant AMIs and stop the instances.

Answer

Create a service catalog product for EC2 with allowed AMIs.

Answer

Use AWS Systems Manager to enforce AMI compliance.

Question 10

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Accepted Answer

A central S3 bucket in the logging account.. Option C is correct because a centralized logging architecture requires one destination S3 bucket, created in the designated logging (central) account, to which all source accounts deliver their log data. Option D is correct because the central bucket must have a bucket policy that explicitly grants the source accounts (or their principals) s3:PutObject permission, otherwise cross-account writes are denied by default. Option E is correct because each source account needs an IAM role (or equivalent identity) with permissions to write objects into the central bucket, allowing the account's logging service to assume it and deliver logs cross-account. Option A is not required because CloudWatch Logs subscription filters are only needed when routing CloudWatch Logs to destinations such as Kinesis or Lambda, not for the core S3-based centralized logging setup. Option B is not required because CloudTrail must be enabled in each source account whose activity is being logged, not only in the central account.

Answer

Amazon CloudWatch Logs subscription filter in each account.

Answer

AWS CloudTrail in the central account only.

Question 11

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.. The SCP explicitly denies all EC2 instance types except t2.micro and t2.small. Since t2.medium is not in the allowed list, the deny effect applies, and the instance launch is blocked. SCPs act as a guardrail that overrides any Allow in IAM policies within the affected accounts.

Answer

The instance launches only if the developer's IAM policy explicitly allows t2.medium.

Answer

The instance launch is allowed because there is no explicit Allow statement in the SCP.

Answer

The instance launches successfully because the SCP does not affect IAM users.

Question 12

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

Accepted Answer

Nothing, because the management account's SCP applies to all accounts.. SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.

Answer

Full access to all AWS services because no SCP is applied to the DevAccount.

Answer

Only read-only actions because of default SCP.

Answer

Only actions allowed by the root user's implicit full access.

Question 13

A security engineer created the above bucket policy on the central-logging-bucket in account 111111111111. They want account 222222222222 to deliver CloudTrail logs to this bucket. What is missing?

Accepted Answer

The bucket policy must grant s3:PutObject to the CloudTrail service principal, not to a role.. CloudTrail delivers logs to S3 buckets by assuming a service-linked role, but the bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) rather than to an IAM role in the target account. This is because CloudTrail uses its own service principal to write logs, not a cross-account IAM role. Without this permission, the CloudTrail delivery will fail with an access denied error.

Answer

The prefix AWSLogs/111111111111 is incorrect; it should use the source account ID 222222222222.

Answer

The role CrossAccountRole does not exist in account 222222222222.

Answer

The bucket must be in the same account as CloudTrail.

Question 14

A multinational company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled. The company wants to enforce this policy centrally without modifying each bucket individually. Which solution is MOST effective?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless encryption is set.. AWS Organizations Service Control Policies (SCPs) can centrally restrict permissions across all member accounts. By applying an SCP to the root organizational unit that denies the s3:PutBucketEncryption action unless the request includes encryption configuration (e.g., by checking for the presence of a server-side encryption algorithm condition), the security team enforces that any new bucket encryption settings must enable server-side encryption. This approach requires no per-bucket or per-account configuration and works even against administrators in member accounts.

Answer

Create an IAM role that all users must assume to create buckets, and attach a policy requiring encryption.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to enable encryption.

Answer

Enable default encryption on each S3 bucket using a custom AWS Config rule.

Question 15

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.. AWS CloudFormation StackSets allows you to deploy the same IAM role across multiple accounts in an AWS Organization in a single, automated operation. By enabling trusted access with AWS Organizations, the role can be centrally managed and automatically deployed to new accounts as they are added, ensuring the solution scales without manual intervention.

Answer

Use a service control policy (SCP) to enforce the creation of the role.

Answer

Manually create the same IAM role in each account with a trust policy pointing to the security account.

Answer

Use IAM groups in the security account and grant permissions to the groups.