SAP-C02 Design Solutions for Organizational Complexity Practice Test 9 — 15 Questions

Question 1

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

Accepted Answer

Amazon Kinesis Data Firehose delivery stream with cross-account access. Option B is correct because Amazon Kinesis Data Firehose can receive logs from multiple accounts via subscriptions and deliver to OpenSearch. Option A is wrong because CloudWatch Logs subscription can forward logs but requires each account to have a subscription filter. Option C is wrong because S3 is a destination, not a forwarding mechanism. Option D is wrong because Lambda can process logs but is not designed for centralized cross-account ingestion.

Answer

Amazon S3 bucket with cross-account bucket policy

Answer

Amazon CloudWatch Logs subscription filter

Answer

AWS Lambda function in each account that sends logs to a central API

Question 2

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts. Option D is correct because CloudFormation StackSets can deploy the required resources across all accounts efficiently. Option A is wrong because manually configuring each account is not efficient. Option B is wrong because AWS Config can detect but not deploy. Option C is wrong because SSM Automation documents are run per account but require additional setup.

Answer

Manually create VPC flow logs in each account and point to the central S3 bucket

Answer

Use AWS Config rules to enforce flow log creation across accounts

Answer

Use AWS Systems Manager Automation to create flow logs in each account

Question 3

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

Accepted Answer

AWS CloudTrail for management events and Amazon S3 server access logs. Option A is correct because CloudTrail logs S3 management events (including bucket policy changes and encryption settings) and S3 server access logs record object-level access. Option B is wrong because CloudWatch Logs does not directly log S3 configuration changes. Option C is wrong because AWS Config can track configuration changes but not access logs. Option D is wrong because CloudWatch Events can trigger on events but not provide historical logging.

Answer

Amazon CloudWatch Events and Amazon S3 event notifications

Answer

Amazon CloudWatch Logs and VPC Flow Logs

Answer

AWS Config and AWS CloudTrail

Question 4

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

Accepted Answer

Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions. Option D is correct because SCPs can deny creation of roles with trust policies that include a specific condition (like a principal that is not within the organization) unless approved. Option A is wrong because IAM policies cannot prevent role creation. Option B is wrong because AWS Config can detect but not deny. Option C is wrong because Lambda can revoke but not prevent.

Answer

Use IAM policies to restrict who can create roles

Answer

Use AWS Lambda to automatically delete non-compliant roles

Answer

Use AWS Config rules to detect and alert on risky trust policies

Question 5

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

Accepted Answer

Use Systems Manager Explorer with multi-account management. Option C is correct because Systems Manager Explorer provides a centralized view of operational data across accounts. Option A is wrong because Systems Manager Automation runbooks are for automation, not centralized management. Option B is wrong because AWS Config is for compliance, not management. Option D is wrong because CloudFormation is for infrastructure deployment.

Answer

Use AWS Config to aggregate configuration data

Answer

Use Systems Manager Automation runbooks in each account

Answer

Use CloudFormation StackSets to deploy Systems Manager agents

Question 6

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

Accepted Answer

Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM. Option B is correct because Route 53 Resolver rules can be shared with other accounts using AWS Resource Access Manager (RAM), and outbound endpoints can forward queries. Option A is wrong because VPC peering does not support DNS resolution of private hosted zones across accounts by default. Option C is wrong because PrivateLink is for accessing services, not DNS. Option D is wrong because CloudFormation does not provide DNS resolution.

Answer

Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account

Answer

Create a VPC peering connection between each VPC and the central account's VPC

Answer

Use AWS PrivateLink to connect VPCs to a central DNS service

Question 7

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

Accepted Answer

Use a service control policy (SCP) that denies EC2 RunInstances unless the AMI ID matches the approved list. Option A is correct because SCPs can deny EC2 RunInstances if the AMI ID is not in a list. Option B is wrong because Config rules can detect but not enforce. Option C is wrong because IAM policies are per-account and can be overridden. Option D is wrong because CloudFormation cannot enforce non-CloudFormation launches.

Answer

Use IAM policies in each account to restrict the AMI ID

Answer

Use AWS Config rules with auto-remediation to stop non-compliant instances

Answer

Use CloudFormation StackSets to enforce AMI IDs for all new instances

Question 8

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Accepted Answer

Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it. Option C is correct because the standard cross-account access pattern uses IAM roles with trust policies. Option A is wrong because IAM users are per-account and not scalable. Option B is wrong because access keys are not secure for cross-account access. Option D is wrong because SCPs are for restrictions, not granting access.

Answer

Use a service control policy to allow access from other accounts

Answer

Create IAM users in the development account for each developer

Answer

Share the access keys of an IAM user in the development account

Question 9

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation. Options A and D are correct. SCPs can prevent disabling CloudTrail or modifying the trail. AWS Config rules can detect missing or misconfigured trails. Option B is wrong because IAM roles do not enforce CloudTrail. Option C is wrong because Lambda can create but not enforce. Option E is wrong because CloudFormation can deploy but not prevent removal.

Answer

Create an IAM role in each account that requires CloudTrail to be enabled

Answer

Use CloudFormation StackSets to deploy a CloudTrail trail in each account

Answer

Use AWS Lambda to automatically re-enable CloudTrail if it is disabled

Question 10

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Accepted Answer

AWS Organizations. Options A, C, and D are correct. IAM Access Analyzer helps identify external access to resources. AWS CloudTrail logs all API calls for auditing. AWS Organizations provides a central view and management of accounts. Option B is wrong because AWS Config is for resource configuration, not IAM permissions. Option E is wrong because Amazon GuardDuty is for threat detection, not IAM audit.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 11

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Accepted Answer

An external identity provider (IdP) such as Azure AD or Okta. Options A and D are correct. AWS SSO requires an identity source (like an external IdP) and permission sets to assign access. Option B is wrong because Cloud Directory is not used with AWS SSO. Option C is wrong because IAM users are not used for SSO. Option E is wrong because SCPs are for organizations, not SSO.

Answer

AWS Cloud Directory

Answer

A service control policy (SCP) attached to the root

Answer

An IAM user in each account

Question 12

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

Accepted Answer

The SCP is not attached to the correct OU or root. Option B is correct because the SCP denies RunInstances only when the instance type is not t3.micro or t3.small, but it applies only to the instance resource (arn:aws:ec2:*:*:instance/*). The RunInstances action also requires permissions on other resources like images, network interfaces, etc. If the SCP does not cover those resources, the condition may not be evaluated fully, or the SCP might not deny the action if other resources are not specified. Alternatively, the SCP might not be attached to the correct OU, or there might be an allow SCP overriding it. The most common issue is that the SCP is not attached to the correct path. Option A is wrong because SCPs do not need to allow actions explicitly; they are deny-only. Option C is wrong because the syntax is correct. Option D is wrong because SCPs do not require an Allow statement to work.

Answer

The SCP syntax is invalid because it uses StringNotEquals

Answer

The SCP must also allow the allowed instance types in a separate statement

Answer

The SCP does not include an Allow statement for the allowed instance types

Question 13

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

Accepted Answer

The trust policy only allows the root user, not individual users. Option C is correct because the trust policy allows the root user but not individual users. To allow a user to assume the role, the trust policy must specify the user's ARN, or the user must have explicit permission in their account to assume the role (via an IAM policy). Option A is wrong because the policy is valid. Option B is wrong because it is exactly that. Option D is wrong because SCPs in the role's account could deny, but the trust policy itself is the issue.

Answer

A service control policy in account 222222222222 is denying the sts:AssumeRole action

Answer

The role is not in the same region as the user

Answer

The trust policy is malformed

Question 14

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

Accepted Answer

The trail is not an organization trail. Option D is correct because the trail is not an organization trail (IsOrganizationTrail: false). Organization trails automatically apply to all accounts in the organization. Without that, each account must create its own trail. Option A is wrong because global service events are enabled. Option B is wrong because multi-region is not required for management events if the trail is in the correct region, but organization trail is the key. Option C is wrong because log file validation does not affect coverage.

Answer

The trail is not a multi-region trail

Answer

The trail does not include global service events

Answer

The trail has log file validation enabled, which prevents cross-account delivery

Question 15

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

Accepted Answer

Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.. Option B is correct because SCPs allow you to centrally control the maximum available permissions for all accounts in an organization, enabling region restrictions at the organizational level. Option A is wrong because IAM policies in individual accounts are harder to manage across many accounts. Option C is wrong because AWS Config does not enforce policies, it only checks compliance. Option D is wrong because Service Control Policies (SCPs) are the correct mechanism for this, not IAM roles.

Answer

Create an IAM role in each account with a policy to deny non-compliant regions.

Answer

Use AWS Config rules to detect and terminate instances in non-compliant regions.

Answer

Create an IAM policy in each account to deny non-compliant regions.