20+ practice questions focused on Design Solutions for Organizational Complexity — one of the most tested topics on the AWS Certified Solutions Architect Professional SAP-C02 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Design Solutions for Organizational Complexity PracticeRefer to the exhibit. A company runs the AWS CLI command to list accounts in AWS Organizations. The company wants to remove the account '444444444444' from the organization. What must the company do first before it can remove this account?
Explanation: To remove a member account from an AWS Organization, the management account must first close the account if it was created within the organization. This is a prerequisite because accounts created via Organizations cannot be removed directly; only invited accounts can be removed without closing. Closing the account initiates the removal process, and the account becomes a standalone account with billing resolved.
A multinational corporation is migrating its on-premises Active Directory (AD) to AWS Managed Microsoft AD. The company has a hub-and-spoke VPC topology with a central transit gateway. The AD domain controllers must be deployed in two different AWS Regions for disaster recovery. The corporate security policy requires that all AD traffic between Regions must traverse the transit gateway and be inspected by a third-party firewall appliance deployed in the inspection VPC. Which architecture meets these requirements?
Explanation: It uses cross-Region transit gateway peering, which allows VPCs in different Regions to communicate through their respective transit gateways. By attaching both VPCs to their local transit gateways and peering those gateways, you can configure route tables to force AD traffic through the inspection VPC in one Region, satisfying the firewall inspection requirement. Option D is incorrect because you cannot attach a VPC in a secondary Region to a transit gateway in the primary Region; transit gateway attachments are regional.
A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?
Explanation: It uses AWS Config rules to detect noncompliant S3 buckets (e.g., missing versioning or KMS encryption) and triggers an automated Lambda remediation to enable versioning and encryption. This ensures compliance with minimal manual intervention, though it does incur some operational overhead for Lambda maintenance. Option A is incorrect because SCPs cannot enforce versioning at bucket creation—versioning is enabled after creation via PutBucketVersioning, and the headers mentioned in the explanation do not exist. Option B only alerts and does not enforce. Option C is not scalable for OU-level enforcement and can be bypassed.
A company uses AWS Organizations with multiple OUs. The security team wants to prevent all accounts in the 'Production' OU from using non-compliant EC2 instance types, but allow exceptions for specific accounts. Which combination of controls should be used?
Explanation: Using resource tags combined with IAM conditions in Service Control Policies (SCPs) allows enforcement at the OU level while enabling exceptions. A Deny SCP can be attached to the Production OU that denies ec2:RunInstances for non-compliant instance types unless the resource has a specific tag (e.g., 'Compliant: true'). Exception accounts can then tag their instances with the required tag to bypass the denial. This approach effectively uses IAM condition keys within an SCP, not IAM policies attached to accounts, and provides a scalable mechanism for exceptions.
A company has multiple AWS accounts and wants to centralize logging from all accounts to a single S3 bucket in a logging account. The logs must be encrypted with a KMS key managed by the logging account. What is the MOST secure way to allow cross-account S3 server access logs?
Explanation: S3 server access logs are delivered by the S3 log delivery service, which operates under the service principal `log-delivery.log.amazonaws.com`. To allow cross-account log delivery to a KMS-encrypted bucket, the bucket policy must grant `s3:PutObject` to that service principal, and the KMS key policy must grant `kms:GenerateDataKey` and `kms:Decrypt` to the same service principal. This ensures the logging account retains full control of the key while enabling secure, auditable log delivery from any source account.
+15 more Design Solutions for Organizational Complexity questions available
Practice all Design Solutions for Organizational Complexity questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Design Solutions for Organizational Complexity. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Design Solutions for Organizational Complexity questions on the SAP-C02 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Design Solutions for Organizational Complexity is tested as part of the AWS Certified Solutions Architect Professional SAP-C02 blueprint. Practicing with targeted Design Solutions for Organizational Complexity questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SAP-C02 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Design Solutions for Organizational Complexity is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Design Solutions for Organizational Complexity practice session with instant scoring and detailed explanations.
Start Design Solutions for Organizational Complexity Practice →