SAP-C02 Design Solutions for Organizational Complexity Practice Test 8 — 15 Questions

Question 1

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

Accepted Answer

Create a StackSet that references an Amazon S3 bucket containing a JSON file with account-specific parameters, including unique CIDR blocks for each account.. Option B is correct because AWS CloudFormation StackSets can use account-specific parameters via a parameter file in Amazon S3, allowing each account to have a unique CIDR. Option A is wrong because it uses a single CIDR for all accounts, causing overlap. Option C is wrong because AWS Service Catalog does not handle dynamic CIDR assignment across many accounts. Option D is wrong because a custom Lambda function per account is not scalable.

Answer

Use AWS Service Catalog to create a product that deploys the VPC, and share the portfolio with each account.

Answer

Write a custom AWS Lambda function that iterates through each account and deploys the CloudFormation template with a different CIDR.

Answer

Create a StackSet with a single parameter for the CIDR block and deploy it to all accounts.

Question 2

A company has a centralized logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all member accounts in AWS Organizations. The logs are stored in an S3 bucket in the logging account. Security analysts need to query these logs using Amazon Athena. What is the MOST efficient way to set up the table partitions?

Accepted Answer

Use AWS Glue Crawler to create a table, then manually add partitions for each account ID and region.. Option A is correct because partitioning by account ID and region reduces the data scanned per query. Option B is wrong because partitioning by date only does not leverage the account structure. Option C is wrong because Glue Crawler can infer schema but does not automatically create partitions efficiently. Option D is wrong because partitioning by log type and date is less efficient than account and region for cross-account queries.

Answer

Use AWS Glue Crawler to create a table with no partitions, and query the entire dataset each time.

Answer

Use AWS Glue Crawler to automatically create partitions based on the date prefix in the S3 key.

Answer

Use AWS Glue Crawler to create a table partitioned by log type and date.

Question 3

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

Accepted Answer

The SCP only denies future API calls; it does not affect already running instances.. Option C is correct because SCPs cannot affect resources created before the SCP was applied. Option A is wrong because SCPs do not affect IAM users in the management account unless explicitly applied. Option B is wrong because SCPs take effect within minutes. Option D is wrong because SCPs can use conditions based on instance type.

Answer

The SCP has a delay of up to 24 hours before it takes effect.

Answer

The SCP is not attached to the management account.

Answer

The SCP condition is incorrectly formatted; SCPs cannot evaluate instance types.

Question 4

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

Accepted Answer

Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.. Option A is correct because the workload VPCs need to forward DNS queries to the outbound endpoint via a rule. Option B is wrong because the inbound endpoint is for on-premises to resolve AWS resources. Option C is wrong because a private hosted zone is not directly related to forwarding. Option D is wrong because VPC peering is not required when using Transit Gateway.

Answer

Establish VPC peering between the workload VPCs and the networking account VPC.

Answer

Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

Answer

Create a Route 53 Resolver inbound endpoint in the networking account.

Question 5

A company has an AWS Organization with a management account and several member accounts. The management account hosts a central S3 bucket that stores CloudTrail logs from all accounts. The company wants to ensure that only the management account can delete objects from this bucket. Which policy should be applied to the bucket?

Accepted Answer

A bucket policy that denies s3:DeleteObject unless the request is from the management account's root user.. Option B is correct because a bucket policy with a condition that denies DeleteObject actions unless the account is the management account achieves the goal. Option A is wrong because it does not prevent other accounts from deleting. Option C is wrong because SCPs cannot be applied to resources. Option D is wrong because bucket policies cannot be attached to organizational units.

Answer

An SCP that denies s3:DeleteObject for all member accounts.

Answer

An SCP that denies s3:DeleteObject for all accounts except the management account.

Answer

A bucket policy that allows s3:DeleteObject only for the organizational unit containing the management account.

Question 6

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

Accepted Answer

Partition by date and account ID.. Option C is correct because the most common query filters are by account and date, so partitioning by date and account ID reduces scans. Option A is wrong because it does not include date, which is a common filter. Option B is wrong because it only includes account ID, missing date. Option D is wrong because region is less selective than account.

Answer

Partition by region and date.

Answer

Partition by account ID only.

Answer

Partition by account ID and region.

Question 7

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

Accepted Answer

The SCP does not include an explicit allow for the sts:GetSessionToken action.. Option D is correct because the SCP must allow the STS:GetSessionToken action to allow MFA based temporary credentials. Option A is wrong because MFA is not required for root user in this context. Option B is wrong because SCPs override IAM permissions. Option C is wrong because SCPs apply to all principals, including users with administrative privileges.

Answer

The IAM policy attached to the users does not allow any actions.

Answer

The SCP does not apply to users who have administrative privileges.

Answer

The SCP also denies access to the root user of each account.

Question 8

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

Accepted Answer

Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.. Option B is correct because AWS Config conformance packs can be deployed across accounts and regions via StackSets. Option A is wrong because it requires manual setup in each account. Option C is wrong because CloudFormation StackSets directly deploy templates, but conformance packs are specifically designed for Config rules. Option D is wrong because AWS Config aggregator only aggregates data, does not deploy rules.

Answer

Use an AWS Config aggregator to deploy rules across accounts.

Answer

Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

Answer

Use AWS Config to create a custom rule in each account manually.

Question 9

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Accepted Answer

Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.. Options A and D are correct. Option A: VPC Flow Logs can be published to a central bucket using a bucket policy that allows the member accounts to write. Option D: The bucket policy must grant s3:PutObject permissions to the member accounts' VPC Flow Logs service. Option B is wrong because bucket policies cannot be applied via SCP. Option C is wrong because SCPs cannot be attached to resources. Option E is wrong because sharing the bucket via RAM is not needed; bucket policy suffices.

Answer

Attach an SCP to the logging account that allows PutObject to the bucket.

Answer

Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.

Answer

Attach an SCP to the member accounts that allows them to create flow logs.

Question 10

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.. Options A and C are correct. Option A: An SCP can be used to deny the sts:AssumeRole action if the request does not come from the corporate IP range. Option C: An IAM policy with a condition on the source IP can be attached to the roles. Option B is wrong because SCPs cannot be attached to roles. Option D is wrong because AWS WAF is for web traffic, not IAM. Option E is wrong because VPC endpoints do not enforce source IP.

Answer

Use a VPC endpoint for STS and restrict access to the endpoint.

Answer

Configure AWS WAF to block requests from IPs outside the corporate range.

Answer

Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.

Question 11

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Accepted Answer

Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.. Options B, C, and D are correct. Option B: A StackSet is needed to deploy the template across accounts. Option C: The template must be created with the S3 bucket resource. Option D: The StackSet needs IAM roles to create resources in target accounts. Option A is wrong because StackSets do not require a service role in each account manually; they use a delegated administrator. Option E is wrong because SCPs are not required for this deployment.

Answer

Create an IAM role in each member account that allows CloudFormation to create resources.

Answer

Create an SCP that allows CloudFormation to create S3 buckets.

Question 12

A security engineer attaches this SCP to the root organizational unit. What is the result?

Accepted Answer

All IAM users and roles must use MFA for any AWS API call.. Option B is correct because the SCP denies all actions if MFA is not present. This effectively requires MFA for all API calls, including console login and CLI. Option A is wrong because it applies to all principals, not just IAM users. Option C is wrong because the SCP denies, not allows. Option D is wrong because it does not require MFA for root user only; it affects all principals, except root user is not affected by SCPs.

Answer

All actions are allowed only if MFA is not used.

Answer

Only the root user is required to use MFA.

Answer

All IAM users must use MFA to access the console, but API calls are not affected.

Question 13

A solutions architect sees this output from the AWS CLI. The management account (111111111111) has a service control policy (SCP) attached that denies all actions unless the request originates from a specific IP range. Which account(s) are affected by this SCP?

Accepted Answer

Only the ProductionAccount (222222222222).. Option A is correct because SCPs attached to the root or OU affect all member accounts, but not the management account itself. The management account (111111111111) is not affected by SCPs. Option B is wrong because the management account is not affected. Option C is wrong because the production account is a member account and is affected. Option D is wrong because only the production account is affected.

Answer

Neither account.

Answer

Both accounts.

Answer

The ManagementAccount (111111111111) only.

Question 14

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

Accepted Answer

The launch fails because the SCP denies the action.. Option C is correct because the SCP denies RunInstances if the instance type is not t3.micro. Since m5.large is not t3.micro, the action is denied. Option A is wrong because the SCP denies the action. Option B is wrong because the condition denies non-t3.micro instances. Option D is wrong because the SCP does not allow; it denies.

Answer

The launch succeeds because the condition evaluates to true.

Answer

The launch succeeds because the SCP only denies StartInstances.

Answer

The launch succeeds because the SCP allows all instance types except t3.micro.

Question 15

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

Accepted Answer

Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met. Option D is correct because SCPs can be used to deny S3 bucket creation or modification if encryption is not set to the required KMS key. Option A is wrong because IAM policies in individual accounts cannot be enforced across accounts. Option B is wrong because AWS Config rules can detect but not enforce. Option C is wrong because CloudFormation StackSets can deploy resources but cannot enforce existing buckets.

Answer

Create IAM policies in each account to enforce encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Deploy a CloudFormation StackSet that creates S3 buckets with encryption