SAP-C02 Design Solutions for Organizational Complexity — Timed 40 Questions

Question 1

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

Accepted Answer

Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.. Option C is correct because SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Answer

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Answer

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Answer

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Question 2

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.

Question 3

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

Accepted Answer

Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.. AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Answer

Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

Answer

Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

Answer

Use an SCP to require CloudTrail to be enabled in each account.

Question 4

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Accepted Answer

The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.. Option C is correct because the S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Answer

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Answer

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Answer

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Question 5

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

Accepted Answer

An SCP that denies the effect of actions that modify billing preferences.. Option D is correct because a Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Answer

An SCP that allows only read-only billing actions.

Answer

An SCP that denies all billing-related actions except read-only.

Answer

An IAM policy attached to the root OU that denies billing modifications.

Question 6

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.

Question 7

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Accepted Answer

Use an SCP to prevent disabling of AWS Config in any account.. Option B is correct because AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Answer

Manually create an S3 bucket in each account to store Config logs.

Answer

Create an IAM role in each account to allow the management account to access Config logs.

Question 8

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

Accepted Answer

The user is not passing the MFA serial number and token code in the assume-role API call.. Option C is correct because the IAM role trust policy includes a condition that checks for the presence of both `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge`. Even though the user has MFA enabled and is passing the MFA token, the `aws:MultiFactorAuthSerialNumber` and `aws:MultiFactorAuthTokenCode` parameters must be explicitly included in the `sts:AssumeRole` API call. Without these, the condition evaluates to false, resulting in an 'AccessDenied' error.

Answer

The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.

Answer

The role requires MFA, but the user's MFA device is not configured correctly.

Answer

The principal is set to the root account, which does not allow IAM users to assume the role.

Question 9

Refer to the exhibit. A company runs the AWS CLI command to list accounts in AWS Organizations. The company wants to remove the account '444444444444' from the organization. What must the company do first before it can remove this account?

Accepted Answer

Remove the account's payment method.. Option C is correct because, before an AWS account can be removed from an AWS Organization, the account must have its payment method removed. This is a prerequisite enforced by AWS to ensure the account is not left in a state where it cannot be billed independently after leaving the organization. The management account cannot directly remove an account that still has an active payment method associated with it.

Answer

Close the AWS account from the management account.

Answer

Create a support ticket to AWS to remove the account.

Answer

The management account can directly remove the account without any prerequisites.

Question 10

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.. Option A is correct because AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Answer

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Answer

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Answer

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Question 11

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Accepted Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.. Option A is correct because the `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to traffic originating from specific VPC endpoints (interface or gateway endpoints). This ensures that only requests coming through approved VPC endpoints can access the data lake, directly enforcing the mandate that access must originate from approved VPCs.

Answer

Enable S3 Block Public Access at the account level.

Answer

Use AWS Certificate Manager to issue certificates for S3 bucket access.

Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.

Question 12

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Answer

AWS Config rules with auto-remediation

Answer

AWS Service Catalog with a portfolio of approved AMIs

Answer

AWS Identity and Access Management (IAM) policies in each account

Question 13

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.. Option D is correct because AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Answer

Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.

Answer

Set up AWS Direct Connect gateway and route all traffic through the security account.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.

Question 14

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

Accepted Answer

Apply tags to resources and enable cost allocation tags in Billing and Cost Management.. Option C is correct because applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Answer

Use Cost Explorer to filter by linked account, which automatically groups by business unit.

Answer

Use AWS Budgets to create budgets per account and manually aggregate.

Answer

Create a separate payer account for each business unit.

Question 15

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

Accepted Answer

Use an SCP to deny the iam:UpdateAccountPasswordPolicy action and deploy a password policy using CloudFormation StackSets.. Option B is correct because an SCP can deny the iam:UpdateAccountPasswordPolicy action, preventing member accounts from altering the password policy, while CloudFormation StackSets can deploy a compliant password policy across all member accounts automatically. This combination provides a preventive control that enforces the minimum 14-character requirement without relying on user action or reactive detection.

Answer

Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

Answer

Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

Answer

Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

Question 16

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Accepted Answer

Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.. Option C is correct because partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Answer

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Answer

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Answer

Use Athena with federated query to scan logs directly from the application accounts.

Question 17

A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?

Accepted Answer

Deploy AD in two Regions, attach both VPCs to a transit gateway in the primary Region, and use a transit gateway inter-Region peering attachment. Configure route tables to force traffic through the inspection VPC in the primary Region.. Option D is correct because it uses a transit gateway in the primary Region with an inter-Region peering attachment to the secondary Region, allowing AD traffic to be routed through the inspection VPC in the primary Region for firewall inspection. This meets the security policy requirement that all cross-Region AD traffic must traverse the transit gateway and be inspected by the third-party firewall appliance.

Answer

Deploy AD in two Regions and use a VPN connection between the VPCs to replicate data.

Answer

Deploy a single AD domain in one Region and use AD replication over a VPC peering connection to a second Region.

Answer

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.

Question 18

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.. A service control policy (SCP) at the OU level can deny the s3:CreateBucket action unless the request includes both the x-amz-bucket-object-locked-enabled-for-bucket-creation header (for versioning) and the x-amz-server-side-encryption-aws-kms-key-id header (for KMS encryption). This enforces compliance at the API level with no ongoing overhead, as the SCP is evaluated before the bucket is created, preventing noncompliant buckets from existing at all.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.

Question 19

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

Accepted Answer

Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.. Option D is correct because AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Answer

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Answer

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Answer

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Question 20

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

Accepted Answer

Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.. Option B is correct because it combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Answer

Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

Answer

Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

Answer

Use AWS Trusted Advisor to check for root user usage and generate a weekly report.