SAP-C02 Design Solutions for Organizational Complexity Practice Test 9 — 15 Questions

Question 1

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a StackSet that references an Amazon S3 bucket containing a JSON file with account-specific parameters, including unique CIDR blocks for each account.. CloudFormation StackSets can reference an Amazon S3 bucket containing a JSON file with account-specific parameters, allowing each account to receive a unique, non-overlapping CIDR block. This approach is fully automated, scalable to 50 accounts, and avoids manual parameter entry or custom code maintenance.

Answer

Use AWS Service Catalog to create a product that deploys the VPC, and share the portfolio with each account.

Answer

Write a custom AWS Lambda function that iterates through each account and deploys the CloudFormation template with a different CIDR.

Answer

Create a StackSet with a single parameter for the CIDR block and deploy it to all accounts.

Question 2

A company has a centralized logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all member accounts in AWS Organizations. The logs are stored in an S3 bucket in the logging account. Security analysts need to query these logs using Amazon Athena. What is the MOST efficient way to set up the table partitions?

Accepted Answer

Use AWS Glue Crawler to create a table, then manually add partitions for each account ID and region.. VPC Flow Logs, CloudTrail, and AWS Config logs are stored in S3 with key prefixes that include account ID, region, and date (e.g., AWSLogs/{account-id}/CloudTrail/{region}/{year}/{month}/{day}/). To efficiently query these logs in Athena, partitions should be created on account ID and region to enable partition pruning, reducing the amount of data scanned. Manually adding partitions for each account ID and region ensures precise control and avoids the overhead of crawling all historical data, which is more efficient than relying solely on automatic date-based partitioning.

Answer

Use AWS Glue Crawler to create a table with no partitions, and query the entire dataset each time.

Answer

Use AWS Glue Crawler to automatically create partitions based on the date prefix in the S3 key.

Answer

Use AWS Glue Crawler to create a table partitioned by log type and date.

Question 3

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

Accepted Answer

The SCP only denies future API calls; it does not affect already running instances.. The most likely cause is that the SCP only denies future API calls, not already running instances. SCPs are evaluated at the time of the API request; any instances launched before the SCP was applied or before it was updated to include the deny condition will continue to run unaffected. The security team may be observing those pre-existing disallowed instances, not new launches.

Answer

The SCP has a delay of up to 24 hours before it takes effect.

Answer

The SCP is not attached to the management account.

Answer

The SCP condition is incorrectly formatted; SCPs cannot evaluate instance types.

Question 4

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

Accepted Answer

Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.. The outbound endpoint forwards DNS queries from the workload VPCs to on-premises resolvers, but it does not automatically configure the workload VPCs to use it. A Route 53 Resolver rule must be created in each workload account (or centrally via RAM) to forward queries for the on-premises domain to the outbound endpoint. Without this rule, the workload VPCs will not send queries for on-premises hostnames to the outbound endpoint, so resolution fails.

Answer

Establish VPC peering between the workload VPCs and the networking account VPC.

Answer

Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

Answer

Create a Route 53 Resolver inbound endpoint in the networking account.

Question 5

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

Accepted Answer

Partition by date and account ID.. Partitioning by date and account ID is most effective because the security team's queries will typically filter by time range and specific accounts. This minimizes data scanned by Athena, which charges per query based on the amount of data read. Partitioning by date first leverages natural time-based access patterns, while account ID further narrows scans when investigating incidents in specific accounts.

Answer

Partition by region and date.

Answer

Partition by account ID only.

Answer

Partition by account ID and region.

Question 6

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

Accepted Answer

The SCP does not include an explicit allow for the sts:GetSessionToken action.. When users authenticate with MFA, the AWS Management Console calls the STS GetSessionToken API to obtain temporary credentials that include the MFA session. If the SCP denies all actions, including sts:GetSessionToken, then even with valid MFA the user cannot obtain the necessary temporary credentials, resulting in access denial. The SCP must explicitly allow the sts:GetSessionToken action for users who authenticate with MFA. Option B is incorrect because the issue is not about the users' IAM policies but about the SCP. Option C is incorrect because SCPs apply to all principals in the account, including administrators. Option D is incorrect because the SCP does not inherently affect the root user differently; root user is not affected by SCPs in the management account.

Answer

The IAM policy attached to the users does not allow any actions.

Answer

The SCP does not apply to users who have administrative privileges.

Answer

The SCP also denies access to the root user of each account.

Question 7

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

Accepted Answer

Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.. AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Answer

Use an AWS Config aggregator to deploy rules across accounts.

Answer

Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

Answer

Use AWS Config to create a custom rule in each account manually.

Question 8

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Accepted Answer

Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.. A bucket policy in the logging account is required to grant cross-account permissions for VPC Flow Logs delivery. Without this policy, the VPC Flow Logs service in member accounts cannot write to the centralized S3 bucket, even if the member account has its own IAM permissions. Option C is correct because the bucket policy must include a condition that restricts the principal to the VPC Flow Logs service (e.g., `aws:SourceArn` or `aws:SourceAccount`) to prevent unauthorized writes from other services or accounts.

Answer

Attach an SCP to the logging account that allows PutObject to the bucket.

Answer

Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.

Answer

Attach an SCP to the member accounts that allows them to create flow logs.

Question 9

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.. An SCP attached to the production OU can deny sts:AssumeRole actions unless the request's source IP falls within the corporate range. SCPs operate at the organization level and apply to all accounts in the OU, providing a centralized guardrail that cannot be overridden by account administrators. This enforces the IP restriction across all IAM roles in the production accounts without modifying individual role trust policies.

Answer

Use a VPC endpoint for STS and restrict access to the endpoint.

Answer

Configure AWS WAF to block requests from IPs outside the corporate range.

Answer

Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.

Question 10

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Accepted Answer

Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.. The CloudFormation template must define the S3 bucket resource with default encryption enabled (e.g., using the `BucketEncryption` property with `AES256` or `aws:kms`) to meet the requirement. Without this configuration in the template, the deployed bucket would not have default encryption, failing the central team's objective.

Answer

Create an IAM role in each member account that allows CloudFormation to create resources.

Answer

Create an SCP that allows CloudFormation to create S3 buckets.

Question 11

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

Accepted Answer

The launch fails because the SCP denies the action.. The SCP explicitly denies the ec2:RunInstances action for any instance type except t3.micro. Since the user attempts to launch an m5.large, the condition does not match, so the default deny applies, and the launch fails. SCPs are evaluated before IAM policies, and an explicit deny in an SCP overrides any allow.

Answer

The launch succeeds because the condition evaluates to true.

Answer

The launch succeeds because the SCP only denies StartInstances.

Answer

The launch succeeds because the SCP allows all instance types except t3.micro.

Question 12

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

Accepted Answer

Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met. A service control policy (SCP) attached to the root of the AWS Organizations hierarchy can deny S3 PutObject or CreateBucket actions unless the request includes the specific KMS key ID (via the s3:x-amz-server-side-encryption-aws-kms-key-id condition key). This enforces encryption centrally across all accounts, as SCPs are inherited by all member accounts and cannot be overridden by IAM policies within those accounts.

Answer

Create IAM policies in each account to enforce encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Deploy a CloudFormation StackSet that creates S3 buckets with encryption

Question 13

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

Accepted Answer

Amazon Kinesis Data Firehose delivery stream with cross-account access. Amazon Kinesis Data Firehose can be configured with cross-account access by using a resource-based policy on the delivery stream that grants permissions to other AWS accounts to write log data directly. This allows logs from multiple accounts to be sent to a single Firehose delivery stream in the central account, which then delivers the logs to the OpenSearch Service domain. The cross-account capability is essential for aggregating logs without requiring intermediate storage or complex custom solutions.

Answer

Amazon S3 bucket with cross-account bucket policy

Answer

Amazon CloudWatch Logs subscription filter

Answer

AWS Lambda function in each account that sends logs to a central API

Question 14

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts. AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization. By defining the VPC flow log resource with the central S3 bucket ARN and the KMS key from the security account (using a cross-account KMS key policy), StackSets can automatically create flow logs in all member accounts with the required encryption, making it the most efficient and centralized approach.

Answer

Manually create VPC flow logs in each account and point to the central S3 bucket

Answer

Use AWS Config rules to enforce flow log creation across accounts

Answer

Use AWS Systems Manager Automation to create flow logs in each account

Question 15

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

Accepted Answer

AWS CloudTrail for management events and Amazon S3 server access logs. AWS CloudTrail management events log changes to S3 bucket policies and encryption settings (e.g., PutBucketPolicy, PutBucketEncryption), while S3 server access logs provide detailed object-level access records. Together, they satisfy the security policy's requirements for detecting configuration changes and logging access, without needing additional services.

Answer

Amazon CloudWatch Events and Amazon S3 event notifications

Answer

Amazon CloudWatch Logs and VPC Flow Logs

Answer

AWS Config and AWS CloudTrail