SAP-C02 Design Solutions for Organizational Complexity Practice Test 9 — 15 Questions

Question 1

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an SCP to the root OU that denies the organizations:LeaveOrganization action and denies the root user's ability to perform actions.. An SCP attached to the root OU can deny the organizations:LeaveOrganization action for all accounts in the organization, preventing any account from leaving. Additionally, an SCP can deny all actions for the root user in member accounts by using a condition key such as "aws:PrincipalType": "Root", which effectively blocks root user operations without affecting IAM users or roles. This approach enforces both requirements centrally without requiring per-account configuration.

Answer

Create an IAM policy that denies the organizations:LeaveOrganization action and attach it to all IAM users.

Answer

Use AWS Config rules to detect when an account leaves the organization and automatically rejoin it.

Answer

Use AWS CloudTrail to monitor and alert on root user activity and organizations:LeaveOrganization.

Question 2

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

Accepted Answer

Create an SCP that denies ec2:RunInstances unless the ami id matches an approved list.. Option A is correct because an AWS Organizations service control policy (SCP) can attach a Deny statement on ec2:RunInstances with a StringNotEquals condition on ec2:ImageId (or a condition key like ec2:ImageID) referencing the approved AMI list, which prevents any principal in member accounts from launching instances with unapproved AMIs — the strongest preventive control in a multi-account setup. Option C is correct because AWS Config rules (e.g., a managed or custom rule checking the AMI ID of running EC2 instances) provide continuous detection of non-compliant launches and can trigger automatic remediation via SSM Automation documents, complementing the preventive SCP. Option B is not correct because AWS RAM shares resources like AMIs across accounts but does not enforce that only approved AMIs are used. Option D is not correct because CloudTrail only records API activity for auditing and alerting; it cannot block or remediate unapproved launches. Option E is not correct because IAM policies attached to roles in each account are not a scalable or reliable enforcement mechanism across an AWS Organizations multi-account environment, and SCPs are the appropriate guardrail.

Answer

Use AWS Resource Access Manager to share the approved AMI with all accounts.

Answer

Use AWS CloudTrail to monitor instance launches and send alerts.

Answer

Attach an IAM policy to each account's IAM roles that allows only approved AMIs.

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally manage CloudWatch Logs from all accounts. The logs should be sent to a central S3 bucket in the management account. Which two actions should the team take? (Choose two.)

Accepted Answer

Configure the S3 bucket policy to allow the member accounts to write objects.. Option B is correct because the central S3 bucket in the management account must have a bucket policy granting the member accounts (or the IAM role they assume) s3:PutObject permission, otherwise cross-account writes from CloudWatch Logs will be denied. Option C is correct because CloudWatch Logs uses an IAM role to deliver log data to a cross-account S3 destination; creating a role in the management account that the member accounts can assume (with a trust policy allowing those accounts) enables the cross-account export. Option A is incorrect because a subscription filter alone cannot target an S3 bucket directly across accounts without the destination role and bucket policy, and it is not the mechanism for centralizing logs to S3. Option D is incorrect because SCPs only restrict permissions and cannot force log groups to export logs to a bucket. Option E is incorrect because CloudTrail delivers API activity logs, not CloudWatch Logs, so it does not satisfy the requirement to centrally manage CloudWatch Logs.

Answer

Create a subscription filter in each member account's log groups that sends logs to the central S3 bucket.

Answer

Apply an SCP that requires all log groups to export logs to the central bucket.

Answer

Use AWS CloudTrail to deliver logs to the central bucket.

Question 4

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

Accepted Answer

The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.. The OrganizationAccountAccessRole in the member account must have a trust policy that explicitly allows the management account's IAM user (or the management account itself) to assume the role. Without this trust relationship, the sts:AssumeRole call from the management account user will be denied, even if the user's IAM policy grants permission to assume the role.

Answer

The IAM role does not exist in the same region as the user.

Answer

An SCP in the member account denies the sts:AssumeRole action.

Answer

The policy does not specify the exact member account ARN.

Question 5

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

Accepted Answer

The SCP policy document does not contain a Deny statement for the regions.. The SCP policy document must explicitly include a Deny statement with a condition that restricts actions to only us-east-1 and eu-west-1. Without a Deny statement, the SCP is effectively permissive (Allow) by default, meaning it does not block actions in other regions. The SCP in the exhibit likely only has Allow statements for the two allowed regions, which does not prevent actions in ap-southeast-1.

Answer

The SCP is not applied to the root user of the member account.

Answer

The SCP cannot restrict actions based on region.

Answer

The SCP is overridden by an Allow policy attached to the account.

Question 6

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

Accepted Answer

The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.. The SCP likely denies s3:PutObject unless encryption headers are present, but the Multipart Upload API uses the s3:UploadPart action for uploading individual parts. Since the SCP only denies s3:PutObject without encryption, the s3:UploadPart action is not covered, allowing unencrypted uploads via multipart uploads. This is why users can still upload objects without encryption despite the SCP.

Answer

The users are using SSE-S3 encryption (AES256).

Answer

The SCP is missing a Deny for s3:PutObject without any encryption header.

Answer

The users are using SSE-C encryption.

Question 7

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.. It uses a central transit gateway with separate route tables for each VPC attachment, which allows the networking team to enable communication between all VPCs via the transit gateway while the security team can isolate specific accounts by controlling which route tables are associated with which VPC attachments. Network ACLs in each VPC provide an additional layer of stateless traffic filtering to restrict traffic between specific VPCs, complementing the route table isolation.

Answer

Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

Answer

Create VPC peering connections between all VPCs and use route tables to control access.

Answer

Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

Question 8

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.. A service control policy (SCP) attached to the member account can enforce a guardrail that denies EC2:RunInstances unless the AMI ID is in an approved list. SCPs define the maximum permissions for accounts in AWS Organizations and are evaluated before IAM policies, so they can enforce organization-wide constraints regardless of individual IAM permissions. This is the correct mechanism to enforce the requirement centrally.

Answer

Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

Answer

Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

Answer

Use AWS Systems Manager to enforce the AMI ID requirement.

Question 9

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

Accepted Answer

Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.. An organization trail in the management account automatically applies to all existing and future accounts and regions within AWS Organizations, capturing all management events without per-account configuration. It delivers logs to a single S3 bucket, and the bucket policy grants read access to all accounts, making it cost-effective by avoiding duplicate trails and reducing storage overhead.

Answer

Use AWS Config to record API calls and deliver to a central S3 bucket.

Answer

Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.

Answer

Use VPC Flow Logs to capture API calls and send to a central S3 bucket.

Question 10

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

Accepted Answer

Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.. A service control policy (SCP) attached to the production OU can deny the ec2:RunInstances action when the request includes the AssociatePublicIpAddress=true parameter. This is a preventive control that applies to all accounts in the OU, regardless of IAM permissions, and does not rely on developer compliance.

Answer

Use the Amazon EC2 'Block public access' feature at the account level.

Answer

Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.

Answer

Use AWS Config to detect instances with public IPs and automatically terminate them.

Question 11

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

Accepted Answer

Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.. AWS Organizations with consolidated billing allows Reserved Instance (RI) discounts to be applied across all accounts in the organization. By purchasing RIs in the management account, the finance team can centrally manage and optimize RI purchases, and the hourly cost and usage benefits are shared across all accounts, maximizing utilization and cost savings.

Answer

Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

Answer

Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

Answer

Have each account purchase its own Reserved Instances based on its usage.

Question 12

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

Accepted Answer

Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.. VPCs do not support resource-based policies (making Option B invalid). An IAM policy with a condition based on a tag can effectively restrict deletion. For example, developers can be allowed to delete VPCs only if the VPC has a specific tag (e.g., 'AllowDeletion: true'), which they can add to their own VPCs. Centrally created VPCs would lack this tag, so deletion is denied. This provides granular control without affecting other permissions.

Answer

Use AWS Config rules to automatically recreate any VPC that is deleted.

Answer

Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.

Answer

Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. Option B is correct because an SCP in AWS Organizations can enforce guardrails across all accounts; specifically, an SCP can deny s3:CreateBucket unless the request includes the s3:x-amz-server-side-encryption condition key (or the bucket is created with default encryption), preventing unencrypted buckets from being created in the first place. Option E is correct because AWS Config rules (such as s3-bucket-server-side-encryption-enabled) can detect non-compliant buckets, and with remediation actions (e.g., AWS Systems Manager Automation) they can automatically apply default encryption to existing buckets, covering resources already created. Option A is not the best fit because a bucket policy denying PutObject without encryption only blocks unencrypted uploads to that specific bucket and does not enforce encryption at rest for the bucket itself or scale across the organization. Option C is incorrect because an IAM policy denying s3:PutObject without encryption applies only to the identities it is attached to, not to all principals or buckets in the organization. Option D is incorrect because S3 Block Public Access controls public access, not encryption at rest, so it does not enforce encryption.

Answer

Attach a bucket policy to each bucket that denies PutObject without encryption.

Answer

Create an IAM policy that denies s3:PutObject unless encryption is specified.

Answer

Enable S3 Block Public Access at the organization level.

Question 14

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Accepted Answer

Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.. Option A is correct because AWS CloudFormation StackSets is the native service for deploying the same CloudFormation template (defining VPCs, CIDR blocks, and subnets) across many accounts in an AWS Organization, using service-managed or self-managed permissions to enforce a consistent baseline. Option B is correct because a service control policy (SCP) attached at the OU or account level sets the maximum permissions for accounts in AWS Organizations, so a deny statement on ec2:CreateVpc with a StringNotEquals condition on the requested CIDR block prevents creation of non-compliant VPCs. Option E is correct because AWS Config rules evaluate resource configurations against desired settings and can flag or remediate noncompliant VPCs, providing the ongoing detection and compliance reporting needed to enforce the standard. Option C is not correct because creating an IAM role only grants permissions to manage VPCs; it does not enforce any CIDR or subnet standard. Option D is not correct because a custom Lambda that terminates VPCs daily is a reactive, destructive workaround rather than a preventive or declarative enforcement mechanism, and it does not establish the required standard configuration.

Answer

Create an IAM role in each account with permissions to manage VPCs.

Answer

Set up AWS Lambda functions to terminate noncompliant VPCs daily.

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.. Option A is correct because an Amazon CloudWatch Events (EventBridge) rule can match AWS API calls made by the root user (for example, via a CloudTrail-backed event pattern on userIdentity.type = Root) and route them to an Amazon SNS topic for immediate alerting. Option D is correct because AWS CloudTrail must be enabled in all accounts to capture and log root user API activity, which is the foundational data source for monitoring and alerting on root actions. Together, CloudTrail provides the logging of root API calls and CloudWatch Events/SNS provides the detection and notification. Option B is not correct because AWS Config rules evaluate resource configuration compliance, not user API activity such as root logins. Option C is not correct because the root user cannot be assigned an IAM role or have its permissions limited in that manner; root has unrestricted account access. Option E is not correct because service control policies do not apply to the management account's root user and cannot reliably deny root user actions across all accounts, especially the management account.

Answer

Use AWS Config rules to detect root user usage.

Answer

Create an IAM role for root user with limited permissions.

Answer

Attach a service control policy (SCP) to all accounts to deny root user actions.