Courseiva

CCNA Design Solutions for Organizational Complexity Questions

75 of 432 questions · Page 1/6 · Design Solutions for Organizational Complexity · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

A.Enable AWS Config aggregator and use advanced queries to search for trust policies.
B.Use AWS Trusted Advisor to check for overly permissive roles.
C.Write a script using AWS SDK to list roles in each account and analyze trust policies.
D.Use IAM Access Analyzer to generate findings for each account.
AnswerA

Config aggregator allows querying across all accounts.

Why this answer

AWS Config aggregator with advanced queries allows you to query the resource configuration of IAM roles across all accounts in AWS Organizations from a single management account. This approach is serverless, scalable, and provides a centralized view without needing to script cross-account access or manage multiple findings. The query can filter on the 'assumeRolePolicyDocument' field to detect trust policies that allow external principals (e.g., 'Effect: Allow' with 'AWS': '*' or a non-account ARN).

Exam trap

The trap here is that candidates confuse IAM Access Analyzer's scope (resource-based policies) with IAM role trust policies, or they assume a custom script is more flexible when AWS Config provides a native, scalable solution for cross-account resource auditing.

How to eliminate wrong answers

Option B is wrong because AWS Trusted Advisor checks for overly permissive security groups and S3 bucket policies, not IAM role trust policies; it does not inspect IAM role trust documents. Option C is wrong because writing a custom SDK script requires managing cross-account IAM roles, handling pagination, and scaling to 200 accounts, which is less efficient and more error-prone than a native AWS Config query. Option D is wrong because IAM Access Analyzer generates findings for resource-based policies (e.g., S3 buckets, KMS keys) but does not analyze IAM role trust policies; its scope is limited to policies that grant access to external entities from the resource itself, not the trust relationship of a role.

Practice this question →
2
MCQeasy

A company has multiple AWS accounts and wants to centralize the management of security policies. The security team needs to enforce that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. The solution must be centrally managed and automatically applied to new accounts as they are added. Which approach should be taken?

A.Use AWS Config to detect IAM users without MFA and send alerts.
B.Create an SCP that denies console access for IAM users if MFA is not present.
C.Use AWS IAM Identity Center to enforce MFA for all users accessing the console.
D.Create an IAM policy in each account that denies console access without MFA.
AnswerB

SCPs are centrally managed and apply to all accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) can centrally deny AWS API actions (including console access) for all IAM users across multiple accounts if the `aws:MultiFactorAuthPresent` condition key is false. This approach is centrally managed from the management account and automatically applies to new accounts added to the organization, meeting the requirement for centralized enforcement and scalability.

Exam trap

The trap here is that candidates confuse IAM Identity Center (federated users) with native IAM users, or they assume AWS Config can enforce policies when it only detects and alerts, leading them to pick a non-preventive or non-centralized solution.

How to eliminate wrong answers

Option A is wrong because AWS Config can detect and alert on IAM users without MFA, but it does not enforce or deny access; it only provides detective controls, not preventive enforcement. Option B is wrong because AWS IAM Identity Center (formerly AWS SSO) manages access for federated users, not for IAM users in individual accounts; it cannot enforce MFA on native IAM users created directly in member accounts. Option D is wrong because creating an IAM policy in each account requires manual per-account deployment and does not automatically apply to new accounts, failing the central management and automatic application requirements.

Practice this question →
3
MCQmedium

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

A.Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.
B.Use AWS Config to record API calls and deliver to a central S3 bucket.
C.Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.
D.Use VPC Flow Logs to capture API calls and send to a central S3 bucket.
AnswerA

Organization trail automatically captures all accounts and future accounts.

Why this answer

An organization trail in the management account automatically applies to all existing and future accounts and regions within AWS Organizations, capturing all management events without per-account configuration. It delivers logs to a single S3 bucket, and the bucket policy grants read access to all accounts, making it cost-effective by avoiding duplicate trails and reducing storage overhead.

Exam trap

The trap here is that candidates confuse AWS Config (resource configuration tracking) with CloudTrail (API call logging), or assume per-account trails are simpler, missing the cost and scalability benefits of an organization trail.

How to eliminate wrong answers

Option B is wrong because AWS Config records resource configuration changes, not API calls; it cannot capture CloudTrail management events. Option C is wrong because enabling CloudTrail individually in each account requires manual setup for every account and region, is not cost-effective due to duplicate log delivery, and does not automatically include future accounts. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols), not API calls; they are unrelated to auditing API operations.

Practice this question →
4
MCQmedium

A company uses AWS Organizations and has a central security account. They want to use AWS Security Hub to aggregate findings from all member accounts. They have enabled Security Hub in the security account and invited all member accounts. However, findings from member accounts are not appearing in the Security Hub console of the security account. What is the most likely cause?

A.The member accounts have not configured Security Hub to send findings to the security account.
B.The IAM role used by Security Hub in the security account does not have permissions to read findings from member accounts.
C.Security Hub cannot aggregate findings from member accounts in different regions.
D.The member accounts have not enabled Security Hub and accepted the invitation.
AnswerD

Each member account must enable Security Hub.

Why this answer

Each member account must enable Security Hub and accept the invitation before findings are aggregated. Option A is wrong because Security Hub supports cross-region aggregation. Option B is wrong because IAM permissions are needed but not the primary cause.

Option C is wrong because there is no such requirement.

Practice this question →
5
Multi-Selecthard

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

Select 2 answers
A.Attach a Service Control Policy (SCP) to the production OU that denies sts:AssumeRole unless the request source IP is within the corporate range.
B.Use a VPC endpoint for STS and restrict access to the endpoint.
C.Configure AWS WAF to block requests from IPs outside the corporate range.
D.Add a condition to the trust policy of each IAM role that requires the source IP to be in the corporate range.
E.Attach a Service Control Policy (SCP) to each IAM role that denies assume role unless the source IP is corporate.
AnswersA, D

SCPs can enforce conditions on API calls.

Why this answer

An SCP attached to the production OU can deny sts:AssumeRole actions unless the request's source IP falls within the corporate range. SCPs operate at the organization level and apply to all accounts in the OU, providing a centralized guardrail that cannot be overridden by account administrators. This enforces the IP restriction across all IAM roles in the production accounts without modifying individual role trust policies.

Exam trap

The trap here is that candidates often confuse SCPs with resource-based policies, thinking SCPs can be attached to individual IAM roles, or they mistakenly believe WAF or VPC endpoints can control IAM API calls, when in fact only SCPs and trust policies directly enforce source IP restrictions on sts:AssumeRole.

Practice this question →
6
Multi-Selectmedium

A company is designing a multi-account AWS environment with a centralized logging account. Which TWO services should be used to aggregate logs from all accounts?

Select 2 answers
A.AWS CloudTrail with cross-account S3 bucket
B.Amazon CloudWatch Logs with cross-account subscription
C.Amazon S3 cross-region replication
D.Amazon VPC Flow Logs
E.Amazon Kinesis Data Firehose
AnswersA, B

CloudTrail can deliver logs to a centralized S3 bucket in another account.

Why this answer

AWS CloudTrail can be configured to deliver log files to an S3 bucket in a centralized logging account by using cross-account S3 bucket policies. This allows all accounts in the organization to send their CloudTrail logs to a single destination, enabling centralized auditing and analysis.

Exam trap

The trap here is that candidates often confuse cross-region replication (Option C) with cross-account log aggregation, not realizing that replication alone does not solve the multi-account collection requirement, and that VPC Flow Logs (Option D) are per-account and need explicit cross-account delivery configuration.

Practice this question →
7
MCQeasy

A company wants to centralize management of IAM users and groups across multiple AWS accounts. The solution should allow users to access resources in any account without needing separate credentials. Which AWS service should be used?

A.AWS Identity and Access Management (IAM)
B.AWS Organizations
C.AWS IAM Identity Center (AWS SSO)
D.AWS Directory Service for Microsoft Active Directory
AnswerC

Provides centralized user management and single sign-on.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized identity source that allows users to sign in once with a single set of credentials and then access multiple AWS accounts and applications. It integrates with AWS Organizations to manage user and group permissions across accounts, eliminating the need for separate IAM users in each account.

Exam trap

The trap here is that candidates often confuse AWS Organizations with a user management service, but Organizations only manages accounts and policies, not user identities or authentication.

How to eliminate wrong answers

Option A is wrong because IAM is account-scoped and cannot centralize user management across multiple AWS accounts; it requires creating separate IAM users in each account, which defeats the goal of single sign-on. Option B is wrong because AWS Organizations provides policy-based management and consolidated billing but does not itself offer a user directory or authentication mechanism; it relies on IAM Identity Center or other identity providers for user access. Option D is wrong because AWS Directory Service for Microsoft Active Directory is a managed AD service that can be used as an identity source, but it is not the AWS-native service for centralizing IAM user and group management across accounts; IAM Identity Center is the recommended service for this purpose.

Practice this question →
8
MCQmedium

A company has a multi-account AWS environment with a central security account. They want to enable Amazon GuardDuty in all accounts and centrally view findings. The security team has already enabled GuardDuty in the security account and invited all member accounts. However, the security account is not receiving findings from all member accounts. Upon investigation, some member accounts show that GuardDuty is not enabled, and some show that they have not accepted the invitation. The team needs a scalable solution to enable GuardDuty across all accounts and ensure findings are sent to the security account. What should the team do?

A.Use AWS Config rules to detect accounts without GuardDuty and send alerts.
B.Use AWS CloudFormation StackSets to deploy GuardDuty resources in each account.
C.Use AWS Control Tower to enable GuardDuty in all accounts via a custom blueprint.
D.Use the GuardDuty delegated administrator feature with AWS Organizations to automatically enable GuardDuty in all accounts and centralize findings.
AnswerD

Automates enablement and centralization.

Why this answer

The GuardDuty delegated administrator feature integrated with AWS Organizations allows the security account to be designated as the GuardDuty administrator, which can then automatically enable GuardDuty for all existing and future member accounts in the organization. This eliminates the need for manual invitations and acceptances, ensuring that findings are centrally aggregated in the security account without requiring per-account configuration.

Exam trap

The trap here is that candidates may choose CloudFormation StackSets (Option B) thinking it can deploy GuardDuty resources across accounts, but they overlook that StackSets cannot automatically accept GuardDuty invitations or leverage the Organizations delegated administrator model to bypass the manual acceptance step.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect noncompliant resources and trigger alerts or remediation actions, but they cannot automatically enable GuardDuty across accounts or manage the invitation/acceptance workflow required for centralized findings. Option B is wrong because CloudFormation StackSets can deploy resources across accounts, but they require the member accounts to already have accepted the GuardDuty invitation or be part of the same organization; they do not automate the invitation acceptance process or leverage the delegated administrator model to bypass manual steps. Option C is wrong because AWS Control Tower custom blueprints are used to deploy additional governance controls or resources, but they do not natively support the GuardDuty delegated administrator feature; enabling GuardDuty across all accounts in Control Tower is better achieved through Organizations integration, not a custom blueprint.

Practice this question →
9
Drag & Dropmedium

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the S3 bucket, then create the trail, configure events, enable security features, and verify delivery.

Practice this question →
10
MCQmedium

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

A.Create an EC2 launch template with the approved AMI and share it with all accounts
B.Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances
C.Use AWS Config rules in each account to detect non-compliant instances and send alerts
D.Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID
AnswerD

SCPs enforce at the API level across all accounts in the organization.

Why this answer

An SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Exam trap

The trap here is that candidates confuse detective controls (Config, CloudTrail/Lambda) with preventive controls (SCPs), assuming that alerting or terminating non-compliant instances is as effective as blocking the launch entirely.

How to eliminate wrong answers

Option A is wrong because sharing an EC2 launch template does not enforce its use; users can still launch instances with other AMIs by ignoring the template. Option B is wrong because CloudTrail monitoring with Lambda termination is a reactive, detective control that allows non-compliant instances to run temporarily, incurring cost and risk before termination. Option C is wrong because AWS Config rules are also detective, only alerting or triggering remediation after a non-compliant instance exists, not preventing the launch.

Practice this question →
11
Multi-Selecthard

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Select 3 answers
A.Apply a service control policy (SCP) that requires AWS Config to be enabled.
B.Create an AWS Config aggregator in the security account to view compliance status across accounts.
C.Use AWS CloudFormation StackSets to deploy the desired AWS Config rules to all accounts.
D.Enable AWS Config in all accounts across the organization.
E.Use AWS CloudTrail to monitor compliance status.
AnswersB, C, D

Centralized dashboard.

Why this answer

An AWS Config aggregator in the security account collects compliance data from all member accounts, providing a centralized view of rule compliance across the organization. This enables the security team to monitor and audit compliance without logging into each account individually.

Exam trap

The trap here is confusing service control policies (SCPs) with service enablement; SCPs restrict permissions but cannot automatically enable AWS Config, leading candidates to incorrectly select option A as a way to enforce compliance.

Practice this question →
12
MCQhard

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

A.The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.
B.The instance launch is denied because the SCP denies any instance type not in the allowed list.
C.The instance launch is denied, but only if the account's IAM policy also denies it.
D.The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.
AnswerB

Correct: the deny effect applies when the condition is true.

Why this answer

The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.

Exam trap

The trap here is that candidates may think `StringNotEquals` is a misconfiguration or that SCPs only apply if the IAM policy also denies, but in reality, an explicit deny in an SCP is absolute and cannot be bypassed by IAM allows.

How to eliminate wrong answers

Option A is wrong because `StringNotEquals` is evaluated correctly by AWS; it denies actions when the specified value does not match the allowed list, not the other way around. Option C is wrong because SCPs are evaluated before IAM policies and can deny actions even if the IAM policy allows them; an explicit deny in an SCP cannot be overridden by an IAM allow. Option D is wrong because the SCP's explicit deny applies to all instance types not in the allowed list, and `t3.large` is not in that list, so the deny is triggered.

Practice this question →
13
MCQeasy

A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?

A.Enable CloudTrail in each account and use S3 Cross-Region Replication to copy logs to a central bucket.
B.Use Amazon Kinesis Data Firehose to stream CloudTrail logs from each account to a central S3 bucket.
C.Enable CloudTrail in each account individually and configure log file delivery to a bucket in that account.
D.Enable AWS CloudTrail in the management account with organization trail, and configure the trail to deliver logs to an S3 bucket in the management account.
AnswerD

Organization trail delivers logs from all accounts to a central bucket.

Why this answer

Enabling an organization trail in the management account automatically applies CloudTrail to all accounts in the AWS Organization, delivering logs to a single S3 bucket in the management account without any per-account configuration or additional replication mechanisms. This meets the 7-year retention requirement with the least operational overhead, as the trail is centrally managed and logs are stored directly in the central bucket.

Exam trap

The trap here is that candidates often assume they must enable CloudTrail in each account individually or use replication/streaming services, failing to recognize that an organization trail in the management account automatically centralizes log delivery from all accounts with minimal configuration.

How to eliminate wrong answers

Option A is wrong because S3 Cross-Region Replication adds operational complexity and cost, and it does not address the need to centrally collect logs from all accounts without per-account CloudTrail setup. Option B is wrong because Amazon Kinesis Data Firehose requires setting up a delivery stream in each account and adds unnecessary complexity and potential data transformation overhead, whereas an organization trail provides direct log delivery. Option C is wrong because it requires enabling CloudTrail individually in each account and then manually aggregating logs from separate buckets, which increases operational overhead and does not leverage the centralized management capabilities of AWS Organizations.

Practice this question →
14
Multi-Selectmedium

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Select 3 answers
A.The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.
B.The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.
C.The execution role in member accounts must have permissions to create the resources defined in the CloudFormation template (e.g., VPC, subnets).
D.Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.
E.The management account must have permission to assume the execution role in member accounts (via IAM trust policy).
AnswersA, C, E

This is the admin role that assumes the execution role in member accounts.

Why this answer

StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Exam trap

The trap here is that candidates often confuse the optional self-managed execution role (option D) as a requirement, when in fact service-managed StackSets eliminate the need for manual role creation in member accounts.

Practice this question →
15
MCQeasy

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users are created in member accounts. All access must be through federated roles. Which approach should they use?

A.Apply an SCP to the root OU that denies the iam:CreateUser action.
B.Set an IAM password policy in each account that requires strong passwords.
C.Use AWS Config rules to detect IAM users and automatically delete them.
D.Use AWS CloudTrail to monitor for CreateUser and alert the security team.
AnswerA

SCPs prevent user creation entirely.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow the security team to centrally restrict permissions across all member accounts. By applying an SCP to the root organizational unit (OU) that denies the `iam:CreateUser` action, no IAM users can be created in any member account, ensuring all access must come from federated roles. SCPs are evaluated before IAM policies and cannot be overridden by account administrators, making them the most effective preventive control.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config or CloudTrail) with preventive controls (like SCPs), assuming that monitoring or alerting can effectively enforce a policy, whereas only SCPs can proactively block the action across all accounts in an organization.

How to eliminate wrong answers

Option B is wrong because setting an IAM password policy does not prevent the creation of IAM users; it only enforces password complexity requirements for existing users, so it fails to meet the goal of blocking user creation entirely. Option C is wrong because AWS Config rules are detective, not preventive; they can detect IAM users after creation but cannot automatically delete them without custom remediation actions, and even then, there is a window where users exist. Option D is wrong because AWS CloudTrail monitoring is also detective; it can alert on `CreateUser` events but does not prevent the action from occurring, so users could still be created before the security team responds.

Practice this question →
16
MCQhard

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

A.Use AWS PrivateLink to connect each VPC to the network account.
B.Create VPC peering connections between each VPC and the network account.
C.Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.
D.Assign new non-overlapping CIDR ranges to each VPC and update all resources.
AnswerC

NAT translates overlapping IPs to unique addresses, enabling communication.

Why this answer

It uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Exam trap

The trap here is that candidates assume Transit Gateway can handle overlapping CIDRs natively, but it cannot; the NAT gateway is required to perform address translation before traffic enters the Transit Gateway, and this is the most scalable solution without renumbering VPCs.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink creates point-to-point connections via Network Load Balancers and endpoint services, which does not resolve overlapping CIDR conflicts between VPCs; it only provides private connectivity to specific services, not full network routing. Option B is wrong because VPC peering requires non-overlapping CIDR ranges to route traffic, and overlapping CIDRs will cause routing conflicts and prevent successful peering connections. Option D is wrong because assigning new non-overlapping CIDR ranges to each VPC is not scalable; it requires extensive reconfiguration of all resources, downtime, and is impractical for a large number of accounts with existing workloads.

Practice this question →
17
Multi-Selectmedium

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Select 2 answers
A.Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.
B.Enable AWS-generated tags automatically for all resources.
C.Use service control policies (SCPs) to require tags on all resources.
D.Apply tags only at the resource creation time; they cannot be added later.
E.Use AWS Cost Explorer to filter costs by tags across accounts.
AnswersA, E

Standardization and enforcement are key for cost allocation.

Why this answer

Defining a standardized set of tags and enforcing them with AWS Config rules ensures consistent cost allocation tagging across all accounts in AWS Organizations. AWS Config rules can evaluate resources for tag compliance and trigger remediation actions, such as automatically tagging resources or sending notifications, which is essential for accurate cost tracking. This approach aligns with the AWS Well-Architected Framework's cost optimization pillar by enabling granular cost allocation and chargeback.

Exam trap

The trap here is confusing service control policies (SCPs) with tag enforcement mechanisms; SCPs control permissions, not resource configurations, so candidates often incorrectly select SCPs for tagging requirements instead of AWS Config rules or tag policies.

Practice this question →
18
MCQmedium

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

A.Use a VPC endpoint to share the database across accounts without data transfer costs.
B.Create a cross-region read replica in the central account and grant access to other accounts.
C.Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.
D.Create an IAM role in each account to access the central RDS instance directly.
AnswerB

This uses a cross-region read replica that can be accessed by other accounts, providing a continuously synced copy for disaster recovery. Although cross-region data transfer costs apply, it is the only option that uses a proper read replica.

Why this answer

Creating a cross-region read replica in the central account and granting access to other accounts allows each account to have a local read replica that stays in sync with the source, providing high availability and disaster recovery while minimizing cross-region data transfer costs (since replicas are in the same region as the source? Actually, the replica is cross-region, so costs are incurred, but among the given options, this is the only one that uses actual read replicas for continuous replication. Option C is wrong because restoring a snapshot creates an independent instance that does not automatically sync with the source, so it does not meet the requirement for continuous replication and disaster recovery.

Exam trap

Candidates often mistakenly think that sharing a snapshot and restoring it creates a read replica, but snapshots are point-in-time and do not replicate ongoing changes. A true read replica requires continuous replication.

How to eliminate wrong answers

Option A is wrong because VPC endpoints (Gateway or Interface endpoints) are used for private connectivity to AWS services within the same region and do not eliminate data transfer costs for cross-region replication; they also cannot share an RDS database across accounts without additional configuration. Option B is wrong because creating a cross-region read replica in the central account and granting access to other accounts would incur cross-region data transfer costs for replication traffic, which contradicts the requirement to minimize such costs. Option D is wrong because creating an IAM role in each account to access the central RDS instance directly does not provide a local read replica for disaster recovery and would introduce cross-region latency and potential single points of failure.

Practice this question →
19
MCQhard

A company uses AWS Organizations with hundreds of accounts. The central IT team wants to manage IP address ranges for VPCs across all accounts using a custom AWS Resource Access Manager (RAM) resource share. They have created a resource share containing the IP address CIDR blocks (as managed prefix lists) and shared it with the organization. However, some accounts cannot see the shared prefix lists. What is the MOST likely cause?

A.The organization's sharing feature for Amazon VPC is not enabled in the management account.
B.Managed prefix lists are not supported by AWS RAM.
C.The accounts need to accept the resource share invitation manually.
D.The resource share can only include one type of resource at a time.
AnswerA

RAM requires enabling sharing with AWS Organizations for each service; VPC sharing must be enabled.

Why this answer

AWS Organizations requires the 'Enable sharing with AWS Organizations' feature to be explicitly enabled in the management account for RAM to share resources with all accounts in the organization. Without this setting, resource shares are limited to individual accounts, and prefix lists shared via RAM will not be visible to member accounts.

Exam trap

The trap here is that candidates often assume sharing with an organization works automatically without any prerequisite configuration, overlooking the explicit enablement step required in the management account.

How to eliminate wrong answers

Option B is wrong because managed prefix lists are fully supported by AWS RAM and can be shared across accounts. Option C is wrong because when sharing with an organization, member accounts do not need to accept invitations; the sharing is automatic once the feature is enabled. Option D is wrong because a single RAM resource share can include multiple resource types, such as prefix lists, subnets, and licenses, as long as they are supported by RAM.

Practice this question →
20
MCQhard

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

A.Enable cost allocation tags and use AWS Cost Explorer to filter by tag.
B.Create AWS Budgets reports for each cost center using tag filters.
C.Export AWS Cost and Usage Reports to Amazon QuickSight and use tag-based filtering.
D.Use AWS Cost Categories to group costs by tag value and set a default rule for untagged resources.
AnswerD

Cost Categories can group costs by tags and assign untagged resources to a default category.

Why this answer

AWS Cost Categories allow you to group costs by tag values and, crucially, set a default rule for untagged resources. This ensures that all resources—tagged or not—are assigned to a cost center, providing the most accurate cost allocation across the entire organization. Other options only filter or report on tagged resources, leaving untagged costs unallocated.

Exam trap

The trap here is that candidates assume tag-based filtering or reporting tools (Cost Explorer, Budgets, QuickSight) can handle untagged resources, but they cannot—only Cost Categories with a default rule can allocate costs for untagged resources.

How to eliminate wrong answers

Option A is wrong because enabling cost allocation tags and using Cost Explorer to filter by tag only reports on resources that already have the tag; untagged resources are excluded, leading to incomplete cost allocation. Option B is wrong because AWS Budgets reports with tag filters also only apply to tagged resources; they do not handle untagged resources, so costs from untagged resources are not tracked by cost center. Option C is wrong because exporting CUR to QuickSight and using tag-based filtering still requires tags to be present on resources; untagged resources are not assigned to any cost center, resulting in inaccurate allocation.

Practice this question →
21
MCQmedium

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

A.Enable AWS CloudTrail in the master account and log sts:AssumeRole events.
B.Create an IAM Access Analyzer in each member account to monitor cross-account access.
C.Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.
D.Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.
AnswerA

CloudTrail logs all STS API calls, providing a centralized audit trail for cross-account role assumptions.

Why this answer

AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Exam trap

The trap here is that candidates often confuse AWS Config (which records resource configuration changes) with CloudTrail (which records API calls), leading them to choose Option C even though it cannot log the actual sts:AssumeRole events needed for auditing.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is designed to identify resources shared with external entities (outside the organization), not to audit or enforce cross-account role assumptions within the same organization. Option C is wrong because AWS Config records configuration changes to IAM roles but does not log the actual sts:AssumeRole API calls; it cannot provide an audit trail of role assumption events. Option D is wrong because a service control policy (SCP) that denies all IAM actions except sts:AssumeRole would prevent users from creating, modifying, or deleting IAM resources in member accounts, but it does not enforce that all IAM users and roles are created only in the master account, nor does it provide auditing of role assumptions.

Practice this question →
22
MCQeasy

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

A.Create an IAM policy that denies EC2 actions unless the region is us-east-1.
B.Use AWS Config to terminate instances in other Regions.
C.Apply an SCP to the account.
D.Configure the default VPC in us-east-1 only.
AnswerA

IAM policy directly restricts user actions.

Why this answer

An IAM policy with a Deny effect for ec2:RunInstances when the region is not us-east-1 directly prevents developers from launching EC2 instances in any other region. This is the simplest approach as it uses native IAM condition keys (aws:RequestedRegion) without requiring additional services or complex configurations.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming SCPs can be applied to a standalone account, but SCPs require AWS Organizations and are not available for a single account without an organization.

How to eliminate wrong answers

Option B is wrong because AWS Config can detect non-compliant instances but cannot terminate them directly; it requires a custom remediation action (e.g., via AWS Systems Manager Automation) which adds complexity and is not the simplest solution. Option C is wrong because Service Control Policies (SCPs) are only available in AWS Organizations, and the question specifies a single AWS account without mentioning an organization, making SCPs inapplicable. Option D is wrong because configuring the default VPC only in us-east-1 does not prevent developers from launching instances in other regions; they can create a new VPC or use a non-default VPC in any region.

Practice this question →
23
Multi-Selectmedium

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Select 2 answers
A.Accounts cannot be moved between OUs once created.
B.Each organizational unit (OU) should contain only one account for security isolation.
C.AWS CloudTrail can be configured to log management events across all accounts from the management account.
D.Service control policies (SCPs) can be used to centrally restrict permissions across accounts.
E.SCPs can only be applied to root accounts, not OUs.
AnswersC, D

CloudTrail can be enabled for all accounts via Organizations.

Why this answer

AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can only be applied to the root account, when in fact they can be attached to any OU or account within the organization.

Practice this question →
24
MCQmedium

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

A.Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.
B.Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.
C.Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.
D.Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.
AnswerD

Run Command can execute commands immediately on targeted instances.

Why this answer

AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts.

Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Practice this question →
25
MCQhard

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

A.Use AWS Organizations to register the member account as a delegated administrator for the service.
B.Create a service-linked role in each account to allow the service to perform actions.
C.Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.
D.Create an IAM role in each account with a trust policy that allows the service to assume it.
AnswerA

Delegated administration allows the member account to manage the service across the organization.

Why this answer

AWS Organizations allows you to designate a member account as a delegated administrator for a specific AWS service. Once registered, that account can perform administrative actions (e.g., creating resources, managing policies) across all accounts in the organization on behalf of that service, without needing individual IAM roles or permissions in each account.

Exam trap

The trap here is that candidates often confuse delegated administration with creating cross-account IAM roles or using the OrganizationAccountAccessRole, not realizing that AWS Organizations provides a native, centralized registration mechanism for service-level delegation.

How to eliminate wrong answers

Option B is wrong because service-linked roles are automatically created by AWS services for their own use, not for delegating administration to a member account; they do not grant cross-account administrative capabilities. Option C is wrong because the OrganizationAccountAccessRole is designed for human administrators to access member accounts via the AWS Management Console or API, not for a service to perform actions programmatically across all accounts. Option D is wrong because creating an IAM role in each account with a trust policy for the service would require manual setup and maintenance in every account, which is not the intended mechanism for delegated administration; AWS Organizations provides a centralized registration process instead.

Practice this question →
26
MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

A.Use AWS Trusted Advisor to check for untagged resources.
B.Use Service Control Policies to deny creation of untagged resources.
C.Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.
D.Use AWS Cost Explorer to filter by tags and manually identify untagged resources.
AnswerC

Cost Categories allocate costs; Budgets can trigger alerts for untagged resources.

Why this answer

AWS Cost Categories allow allocating costs based on rules, and AWS Budgets can alert when untagged resources exist. Option A is wrong because AWS Trusted Advisor can identify untagged resources but cannot enforce cost allocation. Option B is wrong because Service Control Policies can deny creation of untagged resources but do not address cost allocation for existing untagged resources.

Option D is wrong because AWS Cost Explorer can filter by tags but requires manual identification and does not automate cost allocation for untagged resources.

Practice this question →
27
MCQeasy

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

A.The SCP is attached to the root, not the OU.
B.The users have a permissions boundary that allows the actions.
C.The SCP's condition key does not match the actual tag.
D.The users are operating in the management account.
AnswerD

SCPs do not apply to the management account.

Why this answer

SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Exam trap

The trap here is that candidates assume SCPs apply to all accounts in the organization, including the management account, but AWS explicitly exempts the management account from SCP evaluation.

How to eliminate wrong answers

Option A is wrong because attaching the SCP to the root or the OU does not change its applicability—SCPs apply to all member accounts under the root or OU, but never to the management account. Option B is wrong because a permissions boundary can only restrict, not allow, actions beyond what the SCP denies; SCPs are an outer boundary that overrides any IAM permissions, including boundaries. Option C is wrong because if the condition key did not match the actual tag, the SCP would not deny the action, but the question states the SCP is designed to deny actions on EC2 instances with a specific tag; the most likely cause given the scenario is that users are in the management account, not a condition mismatch.

Practice this question →
28
MCQhard

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

A.Use Amazon Inspector to scan for public buckets.
B.Use an SCP to deny making buckets public.
C.Use AWS Config rules to detect public buckets and trigger an AWS Lambda function to make them private.
D.Use AWS CloudTrail to send alerts when a bucket becomes public.
AnswerC

Config rules can invoke Lambda for remediation.

Why this answer

AWS Config rules can continuously evaluate S3 bucket configurations against a custom or managed rule (e.g., 's3-bucket-public-read-prohibited'). When a bucket is detected as publicly accessible, the rule can invoke an AWS Lambda function via an Amazon CloudWatch Events event to automatically apply a bucket policy that removes public access, achieving automated remediation.

Exam trap

The trap here is that candidates often confuse preventive controls (SCPs) with detective and corrective controls (AWS Config + Lambda), assuming SCPs can automatically fix existing non-compliant resources, when in reality SCPs only block future API actions and do not remediate current state.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is designed for vulnerability management and network accessibility assessments of EC2 instances, containers, and Lambda functions, not for scanning S3 bucket public access configurations. Option B is wrong because Service Control Policies (SCPs) can only deny or allow API actions at the account level (e.g., s3:PutBucketPolicy), but they cannot remediate already-public buckets; they prevent future changes but do not fix existing non-compliant resources. Option D is wrong because AWS CloudTrail logs API calls and can send alerts via CloudWatch alarms when a bucket becomes public, but it does not provide automated remediation; it only notifies, leaving the security team to manually fix the issue.

Practice this question →
29
MCQmedium

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

A.The Suspended account was invited to the organization.
B.The Production account is the management account.
C.The Suspended account cannot be used until it is reactivated.
D.The Management account was created directly.
AnswerC

Suspended accounts are not active and must be reactivated.

Why this answer

The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Exam trap

The trap here is that candidates often confuse account status (SUSPENDED) with the method of account creation (invited vs. created), leading them to incorrectly infer that a suspended account must have been invited, when in fact suspension is independent of how the account joined the organization.

How to eliminate wrong answers

Option A is wrong because a suspended account is not necessarily one that was invited; it could have been created directly or invited and then suspended. The status alone does not indicate the invitation method. Option B is wrong because the 'Production' account is listed as a member account (not the management account), as the management account is the one that initiated the organization and is not shown in the list of member accounts.

Option D is wrong because the management account is the original account that created the organization; it is not 'created directly' within the organization — it is the root account that already existed before the organization was formed.

Practice this question →
30
MCQmedium

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

A.Use a VPN connection from each application VPC to the shared VPC.
B.Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.
C.Use VPC peering between the shared VPC and each application VPC.
D.Create IAM roles in each application account that allow the networking team to create VPC attachments.
AnswerB

RAM allows sharing the Transit Gateway, and the networking team can accept or reject attachments via RAM.

Why this answer

AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Exam trap

The trap here is that candidates often confuse IAM permissions (Option D) with resource-based sharing via RAM, thinking that granting IAM roles to create attachments is sufficient, but RAM provides explicit authorization at the resource level, which is more secure and scalable for cross-account access.

How to eliminate wrong answers

Option A is wrong because using a VPN connection from each application VPC to the shared VPC introduces unnecessary complexity, latency, and bandwidth limitations compared to using a Transit Gateway, and it does not scale well as the number of VPCs increases. Option C is wrong because VPC peering requires a one-to-one connection between each application VPC and the shared VPC, which does not scale and creates a mesh of connections that is difficult to manage, and it also does not provide centralized routing or transitive connectivity. Option D is wrong because creating IAM roles in each application account that allow the networking team to create VPC attachments does not control which VPCs can connect; it only grants permission to create attachments, but any VPC in the application account could potentially attach, and it does not enforce authorization at the resource level like RAM does.

Practice this question →
31
Multi-Selecthard

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

Select 2 answers
A.AWS CloudTrail
B.Amazon CloudWatch Logs
C.Amazon GuardDuty
D.Amazon S3
E.AWS Config
AnswersA, B

Logs API calls.

Why this answer

AWS CloudTrail is the service that records all AWS API calls made in an account, capturing the who, what, when, and source IP for every action. To centralize these logs from multiple accounts into a single location, you can configure CloudTrail to deliver log files to a centralized Amazon S3 bucket, and then use Amazon CloudWatch Logs to monitor, search, and alert on those API events in real time. Together, they provide a complete, centralized logging and monitoring solution for API activity across a multi-account environment.

Exam trap

The trap here is that candidates often confuse Amazon S3 as a logging service rather than a storage destination, or they mistakenly think GuardDuty or AWS Config can replace CloudTrail for capturing API calls.

Practice this question →
32
MCQhard

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

A.Allows only t3.micro and t3.small instances to be launched.
B.Denies launching instances that are not t3.micro or t3.small for IAM users and roles, but not root.
C.Has no effect because SCPs cannot deny actions.
D.Denies launching any instance except t3.micro and t3.small for all users including root.
AnswerB

SCPs apply to IAM users and roles, not to root user.

Why this answer

The SCP uses a Deny effect with a condition that denies any EC2:RunInstances action unless the instance type is t3.micro or t3.small. However, SCPs do not affect the root user (the management account's root user) because SCPs cannot restrict the root user in the management account. Therefore, the policy denies launching non-compliant instance types for IAM users and roles, but not for the root user.

Exam trap

The trap here is that candidates often forget that SCPs do not apply to the root user of the management account, leading them to incorrectly assume the policy denies all users including root.

How to eliminate wrong answers

Option A is wrong because the SCP does not allow only those instance types; it denies all others, but the effect is a deny, not an allow, and it does not apply to root. Option C is wrong because SCPs can deny actions; they are a type of policy that can explicitly deny API actions. Option D is wrong because SCPs do not apply to the root user in the management account; root is exempt from SCP restrictions.

Practice this question →
33
MCQmedium

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

A.The CloudWatch Logs subscription filter does not have permissions to write to Firehose.
B.The OpenSearch cluster's access policy denies write access from the Firehose stream.
C.The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.
D.The Firehose delivery stream does not have a TLS certificate configured.
AnswerC

Firehose needs kms:Encrypt and kms:Decrypt permissions on the key.

Why this answer

The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Exam trap

The trap here is that candidates often assume the error is due to network or access policies (Options A or B) rather than recognizing that KMS key policies must explicitly grant encryption permissions to intermediate services like Firehose, which is a subtle but critical requirement for encrypted log pipelines.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the CloudWatch Logs delivery to Firehose is configured correctly, meaning the subscription filter already has the necessary permissions to write to Firehose. Option B is wrong because the OpenSearch cluster's access policy controls access to the cluster itself, not the Firehose delivery stream's ability to write; the error occurs before data reaches OpenSearch, during Firehose's encryption step. Option D is wrong because TLS certificates are used for encrypting data in transit between Firehose and OpenSearch, but the 'AccessDenied' error is related to KMS permissions, not TLS configuration; Firehose automatically uses TLS for data delivery to OpenSearch.

Practice this question →
34
Multi-Selecthard

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

Select 2 answers
A.Add a bucket policy on the central S3 bucket that grants the service principal 'delivery.logs.amazonaws.com' s3:PutObject permission.
B.Create an IAM role in the logging account that the member accounts can assume to put objects.
C.Create an S3 bucket in each member account to receive Flow Logs, and replicate to the central bucket.
D.Configure VPC Flow Logs in each member account to deliver to the central S3 bucket.
E.Enable AWS CloudTrail in the management account to aggregate logs.
AnswersA, D

This allows the Flow Logs service to write to the bucket.

Why this answer

The S3 bucket policy must grant the `delivery.logs.amazonaws.com` service principal the `s3:PutObject` permission. This allows the VPC Flow Logs delivery service, which runs in the member accounts, to write log data directly into the central S3 bucket in the logging account without requiring cross-account IAM roles or temporary credentials.

Exam trap

The trap here is that candidates often assume cross-account access always requires an IAM role (Option B), but VPC Flow Logs use a service principal and bucket policy instead, which is a unique pattern tested in SAP-C02.

Practice this question →
35
MCQhard

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

A.Deploy a third-party log collector agent on each EC2 instance.
B.Configure AWS Transit Gateway to aggregate flow logs.
C.Use a CloudFormation StackSet to deploy VPC Flow Logs to an S3 bucket in the central account using bucket policies.
D.Enable VPC Flow Logs in each account and publish to a CloudWatch Logs group in the central account.
AnswerC

StackSet can create flow logs with cross-account delivery to a central S3 bucket.

Why this answer

Using a CloudFormation StackSet allows you to deploy VPC Flow Logs consistently across multiple accounts and regions, publishing them to a centralized S3 bucket in the logging account. Bucket policies grant cross-account write access, making this approach highly scalable without per-account agent management or CloudWatch Logs cross-account limitations.

Exam trap

The trap here is that candidates may think CloudWatch Logs can natively publish to a cross-account log group, but it cannot; S3 with bucket policies is the correct scalable approach for multi-account VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because deploying a third-party log collector agent on each EC2 instance is not scalable, introduces agent management overhead, and does not capture VPC-level network traffic (only instance-level). Option B is wrong because AWS Transit Gateway does not aggregate or generate flow logs; it is a network transit hub, not a logging service. Option D is wrong because CloudWatch Logs does not support publishing directly to a cross-account log group; you would need to use a subscription filter or a separate solution, and this approach does not scale as well as S3-based centralized storage.

Practice this question →
36
MCQhard

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

A.Create an IAM policy that requires the security group when launching instances with a public IP.
B.Use AWS Config rules to detect non-compliant instances and automatically terminate them.
C.Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.
D.Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.
AnswerD

Prevents non-compliant launches.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Exam trap

The trap here is that candidates often choose AWS Config (Option B) because it is a well-known compliance tool, but they overlook that Config is reactive (detect and remediate) rather than proactive (prevent at the API call), which is the key distinction for 'enforce' in this question.

How to eliminate wrong answers

Option A is wrong because IAM policies are attached to users, roles, or groups and cannot enforce conditions based on the instance's runtime configuration (like public IP assignment) at the time of launch across all accounts in an organization; they also cannot prevent launches by users with full admin privileges. Option B is wrong because AWS Config rules are detective, not preventive—they can detect non-compliant instances and trigger auto-remediation (e.g., termination), but this allows a window of non-compliance and potential cost/security exposure before remediation. Option C is wrong because CloudFormation StackSets deploy templates but cannot enforce a blanket policy across all accounts; users with sufficient IAM permissions can still launch instances manually via the console, CLI, or SDK outside of CloudFormation, bypassing the template's constraints.

Practice this question →
37
MCQhard

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

A.Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.
B.Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.
C.Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.
D.Use S3 bucket policies to deny PutObject if encryption is not set.
AnswerB

SCP prevents new non-compliant buckets; Config remediates existing ones.

Why this answer

An SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Exam trap

The trap here is that candidates often assume AWS Config rules automatically evaluate all existing resources when enabled, but they only evaluate resources on configuration changes after enablement unless a manual or scheduled evaluation is triggered, leading to the misconception that Config alone cannot cover pre-existing buckets.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy templates but cannot enforce encryption on buckets created outside of CloudFormation, and teams can still create buckets via other methods (console, CLI) that bypass the template. Option C is wrong because CloudTrail only detects and alerts on bucket creation events but does not prevent creation of non-compliant buckets or remediate existing ones, leaving the security gap open. Option D is wrong because S3 bucket policies can deny PutObject without encryption but do not enforce encryption at the bucket level (SSE-S3 or SSE-KMS) during bucket creation, and they cannot prevent creation of buckets without encryption settings.

Practice this question →
38
Multi-Selectmedium

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

Select 2 answers
A.Use AWS CloudTrail to detect console logins without MFA and send alerts.
B.Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.
C.Require each IAM user to have a virtual MFA device assigned.
D.Create an IAM group for users without MFA and deny them console access.
E.Attach an IAM policy to all users that denies console access if MFA is not present.
AnswersB, E

This denies actions when MFA is not used.

Why this answer

AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to centrally enforce that any API action is denied unless the request includes MFA. By using the `aws:MultiFactorAuthPresent` condition key set to `false`, the SCP effectively blocks all AWS actions (including console login) for any principal that has not authenticated with MFA. This ensures a blanket, unmodifiable guard across all member accounts, even preventing account administrators from bypassing the requirement.

Exam trap

The trap here is that candidates often confuse detection (CloudTrail) with enforcement (SCP or IAM policy), or they assume that assigning an MFA device is sufficient without a corresponding deny policy, leading them to pick options that only monitor or partially enforce the requirement.

Practice this question →
39
MCQeasy

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

A.Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.
B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.
C.Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.
D.Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.
AnswerA

S3 is cost-effective for central log storage.

Why this answer

Delivering logs from all accounts to a central Amazon S3 bucket in a logging account is the most scalable and cost-effective approach. S3 Lifecycle policies can automatically transition older logs to Amazon S3 Glacier, reducing storage costs while retaining data for compliance. This design avoids cross-account data transfer fees and minimizes operational overhead by using a single bucket with centralized access controls.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing streaming services like Kinesis or CloudWatch Logs, thinking they are more scalable, but they fail to recognize that direct S3 delivery with Lifecycle policies is both more cost-effective and sufficiently scalable for centralized logging in AWS Organizations.

How to eliminate wrong answers

Option B is wrong because using Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket introduces unnecessary complexity and cost, as Firehose incurs per-GB ingestion fees and requires managing stream configurations per account, making it less cost-effective than direct S3 delivery. Option C is wrong because configuring each account to deliver logs to its own S3 bucket and using S3 Replication to copy logs to a central bucket incurs replication costs (per-object and data transfer fees) and adds latency, making it less scalable and more expensive than direct delivery to a single bucket. Option D is wrong because sending logs to CloudWatch Logs in each account and using cross-account subscription filters to forward logs to a central account incurs CloudWatch Logs ingestion and storage costs, as well as data transfer charges, and the subscription filter approach does not scale well for high-volume logs like VPC Flow Logs, leading to potential throttling and higher costs.

Practice this question →
40
Multi-Selectmedium

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Select 2 answers
A.Allow all users to assume cross-account roles for easier management.
B.Share the same VPC across all OUs to simplify networking.
C.Use separate AWS accounts for each environment to provide strong isolation.
D.Use resource tagging to isolate environments instead of accounts.
E.Apply separate SCPs to each OU to enforce different security policies.
AnswersC, E

Separate accounts provide the best isolation between environments.

Why this answer

Using separate AWS accounts for each environment provides strong isolation at the AWS account boundary, which is the most secure and recommended practice for preventing production workloads from being impacted by changes in other environments. Account-level isolation ensures that IAM policies, resource limits, and service quotas are independent, and that no cross-account resource sharing can accidentally affect production.

Exam trap

The trap here is that candidates often confuse logical isolation (like tagging or VPC sharing) with the strong, account-level isolation required for production workloads, and may overlook that SCPs are the correct mechanism to enforce different security policies per OU.

Practice this question →
41
MCQhard

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

A.The launch succeeds because the condition evaluates to true.
B.The launch succeeds because the SCP only denies StartInstances.
C.The launch fails because the SCP denies the action.
D.The launch succeeds because the SCP allows all instance types except t3.micro.
AnswerC

The condition matches, so the deny is applied.

Why this answer

The SCP explicitly denies the ec2:RunInstances action for any instance type except t3.micro. Since the user attempts to launch an m5.large, the condition does not match, so the default deny applies, and the launch fails. SCPs are evaluated before IAM policies, and an explicit deny in an SCP overrides any allow.

Exam trap

The trap here is that candidates may misinterpret the condition logic, thinking the SCP allows all instance types except t3.micro, when in fact it denies all except t3.micro, causing the m5.large launch to fail.

How to eliminate wrong answers

Option A is wrong because the condition evaluates to false for m5.large, not true, so the deny effect applies. Option B is wrong because the SCP denies RunInstances, not StartInstances, and the launch action is RunInstances. Option D is wrong because the SCP does not allow all instance types except t3.micro; it explicitly denies all instance types except t3.micro, meaning only t3.micro is allowed.

Practice this question →
42
MCQmedium

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

A.Deny effect with "*" as the action.
B.Deny effect with NotAction set to ec2:* and rds:*.
C.Allow effect with ec2:* and rds:* as the actions.
D.Deny effect with ec2:* and rds:* as the actions.
AnswerD

This denies all EC2 and RDS operations.

Why this answer

AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Exam trap

The trap here is that candidates confuse NotAction with a targeted deny, mistakenly thinking it blocks only the specified services, when in fact NotAction denies everything except those services.

How to eliminate wrong answers

Option A is wrong because a Deny effect with '*' as the action would block all AWS services, not just EC2 and RDS. Option B is wrong because NotAction with ec2:* and rds:* would deny everything except EC2 and RDS, which is the opposite of the requirement. Option C is wrong because an Allow effect in an SCP does not override an implicit deny; SCPs are deny-only filters and cannot grant permissions, so this would not block EC2 and RDS.

Practice this question →
43
MCQeasy

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

A.Register the member account as a delegated administrator for CloudTrail in AWS Organizations.
B.Create a resource-based policy on the CloudTrail service to allow the member account to create trails.
C.Create an IAM role in the management account and grant the developer permission to assume it.
D.Attach an SCP to the member account that allows CloudTrail actions.
AnswerA

Allows the member account to create organization trails.

Why this answer

Registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Exam trap

The trap here is that candidates often assume creating an IAM role in the management account (Option C) is sufficient, but they miss that organization trails require the member account to be explicitly registered as a delegated administrator in AWS Organizations to bypass the default restriction that only the management account can create organization trails.

How to eliminate wrong answers

Option B is wrong because CloudTrail does not support resource-based policies; it uses IAM policies and service-linked roles for access control. Option C is wrong because while an IAM role in the management account could be assumed, this approach does not enable the member account to create an organization trail directly—organization trails require the member account to be a delegated administrator or have explicit permissions from Organizations. Option D is wrong because SCPs are used to restrict permissions, not to grant them; attaching an SCP that allows CloudTrail actions would not grant the developer the ability to create an organization trail without additional IAM permissions.

Practice this question →
44
MCQhard

A global company with 50 AWS accounts uses AWS Organizations and wants to centralize CloudTrail logs. The security team requires that all accounts send their CloudTrail logs to a central S3 bucket in the audit account. Which combination of steps will ensure this?

A.Use AWS Config to forward logs to a central S3 bucket.
B.Enable CloudTrail in each account and use AWS Organizations to aggregate logs.
C.Create a CloudTrail trail in the audit account that logs all accounts via CloudWatch Logs.
D.Create a CloudTrail trail in the audit account with an S3 bucket, and add a bucket policy that grants cross-account permissions for each member account to deliver logs. Then configure each member account to use the same trail.
AnswerD

This is the standard cross-account CloudTrail setup.

Why this answer

It uses a single CloudTrail trail in the audit account with a central S3 bucket, and the bucket policy grants the necessary s3:PutObject permissions to each member account's CloudTrail service principal. Each member account then configures CloudTrail to use the same trail (the audit account's trail), which allows CloudTrail to deliver logs from all accounts to the central bucket without requiring separate trails or manual log forwarding.

Exam trap

The trap here is that candidates often think they need to enable CloudTrail in each account individually (Option B) or use a different service like AWS Config (Option A), when the correct approach is to create a single organization trail in the audit account with cross-account permissions and have member accounts reference that trail.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration auditing service, not a log delivery mechanism; it cannot forward CloudTrail logs to an S3 bucket. Option B is wrong because enabling CloudTrail in each account individually would create separate trails and separate log deliveries, not centralize logs into a single bucket; AWS Organizations can aggregate trails only when a single organization trail is created from the management account. Option C is wrong because CloudTrail cannot log all accounts via CloudWatch Logs; CloudWatch Logs is a destination for CloudTrail logs, not a mechanism to aggregate logs from multiple accounts.

Practice this question →
45
MCQmedium

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

A.Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.
B.Create a separate pipeline in each account using the same source repository.
C.Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.
AnswerA

Correct. A central DevOps account with cross-account IAM roles aligns with AWS best practices for multi-account environments, especially with Control Tower, providing centralized management and security.

Why this answer

The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity.

Therefore, only Option A fully meets the requirements.

Exam trap

Candidates may think that both A and C are correct, but the question asks for the 'most secure and scalable' approach. Option A explicitly centralizes the pipeline in a dedicated account, which is superior for governance and scalability in a Control Tower setup.

How to eliminate wrong answers

Option B is wrong because creating a separate pipeline in each account duplicates infrastructure, increases management overhead, and does not use a shared artifact store or source repository consistently, leading to potential drift and inconsistency. Option C is wrong because while it mentions cross-account actions, it is essentially the same as Option A but less specific about the central account pattern; however, the question asks for the MOST secure and scalable approach, and Option A explicitly describes the best practice of a central DevOps account with cross-account IAM roles, which is more aligned with AWS Control Tower's multi-account governance model than simply using cross-account actions in CodePipeline without a dedicated central account.

Practice this question →
46
MCQmedium

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

A.Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.
B.Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.
C.Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.
D.Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.
AnswerB

Firewall Manager can enforce security group rules centrally.

Why this answer

AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Exam trap

The trap here is that candidates often confuse AWS Firewall Manager's audit-only mode (which generates reports) with its enforcement mode (which automatically creates and manages security groups), leading them to choose the reporting option instead of the correct enforcement option.

How to eliminate wrong answers

Option A is wrong because AWS Config rules with Lambda remediation are reactive—they detect non-compliant resources after creation and then attempt to fix them, which is not a preventive enforcement mechanism and can introduce latency or race conditions. Option C is wrong because auditing and generating reports only provides visibility into non-compliance but does not actively enforce the policy or prevent insecure security groups from being used. Option D is wrong because SCPs cannot deny specific API actions like ec2:AuthorizeSecurityGroupIngress based on port numbers or IP ranges; SCPs operate at the API action level and cannot inspect the parameters of the request, so they cannot block opening a specific port to the internet.

Practice this question →
47
MCQeasy

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

A.Create an IAM policy that requires tags on all resources and attach it to all IAM users.
B.Configure CloudFormation to reject any stack that does not include tags.
C.Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.
D.Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.
AnswerC

SCPs can enforce that all stacks have required tags, and stack-level tags propagate to resources.

Why this answer

AWS Organizations Service Control Policies (SCPs) can deny the creation of CloudFormation stacks that do not include required stack-level tags, while stack-level tags defined in the template propagate to all resources created by the stack. This combination enforces tagging standards across all stacks without relying on individual IAM user permissions or post-creation remediation.

Exam trap

The trap here is that candidates often choose AWS Config (Option D) because it is a common tagging enforcement tool, but they overlook that it is reactive and does not prevent non-compliant stacks from being created, whereas SCPs provide preventive enforcement at the organization level.

How to eliminate wrong answers

Option A is wrong because IAM policies attached to users can be bypassed if users have permissions to create resources via CloudFormation with a service role that overrides user-level permissions, and IAM policies cannot enforce tags on resources created by CloudFormation if the stack itself is created without tags. Option B is wrong because CloudFormation does not have a native configuration to reject stacks based on missing tags; it only supports stack-level tags as optional metadata and will create stacks without tags if no tags are specified. Option D is wrong because AWS Config detects resources without tags after they are created, which is reactive rather than preventive, and automatic remediation via Systems Manager Automation may not cover all resource types or may incur additional costs and delays.

Practice this question →
48
MCQmedium

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

A.Create an IAM role in each account with a policy to deny non-compliant regions.
B.Use AWS Config rules to detect and terminate instances in non-compliant regions.
C.Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.
D.Create an IAM policy in each account to deny non-compliant regions.
AnswerC

SCPs provide centralized policy enforcement across accounts in an organization.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum permissions for all accounts in an organizational unit (OU). By attaching an SCP that denies EC2 actions in non-compliant regions, you enforce the restriction across multiple accounts without needing to manage individual IAM policies or roles, making it the most scalable solution.

Exam trap

The trap here is that candidates often choose detective solutions like AWS Config (Option B) or per-account IAM policies (Options A and D) because they are familiar, but they miss that SCPs provide a centralized, preventive, and scalable control that applies to all principals, including the root user.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in each account still requires per-account management and does not prevent the root user or other principals from launching instances in non-compliant regions; SCPs apply to all principals including the root user. Option B is wrong because AWS Config rules are detective, not preventive; they can detect and terminate instances after launch, but this is reactive and does not prevent the initial launch, leading to potential cost and security exposure. Option D is wrong because creating an IAM policy in each account requires manual per-account configuration and does not scale; it also cannot restrict the root user, whereas SCPs apply to all principals in the account.

Practice this question →
49
MCQeasy

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

A.Create a backup plan in each account targeting the tagged instances and store backups in the management account's vault using cross-account backup.
B.Use AWS CloudFormation StackSets to deploy a backup plan to each account.
C.Use AWS Backup with a backup policy in AWS Organizations to centrally manage backups across accounts.
D.Use Amazon Data Lifecycle Manager to create cross-account snapshot copies for tagged instances.
AnswerC

AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags.

Why this answer

AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags. Option A is wrong because creating a backup plan in each account is not central management and requires manual setup. Option B is wrong because CloudFormation StackSets deploy infrastructure but do not dynamically manage backups based on tags.

Option D is wrong because Amazon Data Lifecycle Manager is for automated EBS snapshots, not for centralized backup management across accounts.

Practice this question →
50
MCQmedium

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

A.Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.
B.Manually enable Shield Advanced in each account after creation.
C.Use AWS Config to detect accounts without Shield Advanced and send notifications.
D.Use AWS Organizations to create an SCP that requires Shield Advanced.
AnswerA

This automates the setup for all new and existing accounts.

Why this answer

AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Exam trap

The trap here is that candidates often confuse SCPs with proactive resource provisioning, assuming an SCP can enable a service, when in reality SCPs only control permissions and cannot perform actions like subscribing to Shield Advanced.

How to eliminate wrong answers

Option B is wrong because manually enabling Shield Advanced in each account after creation is inefficient, error-prone, and does not scale in a multi-account environment. Option C is wrong because AWS Config can only detect non-compliance and send notifications; it cannot automatically enable Shield Advanced, so it requires additional manual or automated remediation steps, making it less efficient than a proactive deployment. Option D is wrong because AWS Organizations Service Control Policies (SCPs) can only restrict permissions (e.g., deny disabling Shield Advanced) but cannot enable a service or perform actions like subscribing to Shield Advanced; SCPs are not capable of provisioning resources.

Practice this question →
51
MCQeasy

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

A.Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.
B.Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.
C.Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.
D.Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.
AnswerB

StackSets can deploy stacks across accounts and regions from a single admin account.

Why this answer

AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Exam trap

The trap here is that candidates often confuse SCPs with resource policies, thinking they can enforce resource configurations, but SCPs only control IAM permissions and cannot directly enable features like VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because SCPs cannot enforce resource configurations like enabling VPC Flow Logs; they only restrict permissions (e.g., deny actions) and cannot create or modify resources. Option C is wrong because while an AWS Config rule can detect non-compliant VPCs and trigger auto-remediation, it is reactive and requires each account to have the rule deployed, making it less efficient than a proactive, centralized deployment. Option D is wrong because AWS Service Catalog provides a pre-approved product template but does not enforce its use; accounts can still create VPCs without flow logs, so it does not guarantee compliance.

Practice this question →
52
Multi-Selectmedium

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Select 2 answers
A.Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.
B.Attach an SCP to the logging account that allows PutObject to the bucket.
C.Configure the bucket policy to include a condition that the principal is the VPC Flow Logs service.
D.Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.
E.Attach an SCP to the member accounts that allows them to create flow logs.
AnswersA, C

Bucket policy allows cross-account writes.

Why this answer

A bucket policy in the logging account is required to grant cross-account permissions for VPC Flow Logs delivery. Without this policy, the VPC Flow Logs service in member accounts cannot write to the centralized S3 bucket, even if the member account has its own IAM permissions. Option C is correct because the bucket policy must include a condition that restricts the principal to the VPC Flow Logs service (e.g., `aws:SourceArn` or `aws:SourceAccount`) to prevent unauthorized writes from other services or accounts.

Exam trap

The trap here is that candidates often think SCPs or IAM roles in member accounts are sufficient for cross-account S3 writes, but the bucket policy is the only mechanism that authorizes the VPC Flow Logs service principal from another account to write objects.

Practice this question →
53
MCQhard

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

A.Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.
B.Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.
C.Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.
D.Use AWS Cost Explorer to filter by resource tags after they are manually applied.
AnswerB

Tag policies enforce tags across accounts, and cost allocation tags are automatically activated.

Why this answer

AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Exam trap

The trap here is that candidates often confuse reactive remediation (like Config rules with Lambda) with proactive enforcement (like tag policies), and overlook that cost allocation tags must be explicitly activated in the management account to appear in cost reports.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can only apply tags to resources created by CloudFormation stacks, not to resources created outside of CloudFormation or pre-existing resources, and maintaining templates for hundreds of accounts introduces significant ongoing overhead. Option C is wrong because AWS Config rules with Lambda remediation is a reactive, event-driven approach that adds tags after resource creation, which does not guarantee propagation to cost reports automatically and requires ongoing maintenance of Lambda functions and Config rules. Option D is wrong because Cost Explorer can only filter by tags that are already applied and activated; manually applying tags does not ensure automatic propagation to cost reports and requires manual effort, failing the minimal ongoing maintenance requirement.

Practice this question →
54
MCQeasy

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

A.Create a service control policy in AWS Organizations that restricts instance types for all accounts.
B.Use AWS Config to automatically terminate instances that are not of allowed types.
C.Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.
D.Configure an S3 bucket policy that only allows specific instance types to be used.
AnswerC

IAM policies can restrict RunInstances actions based on instance type.

Why this answer

An IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can restrict specific users or groups within an account, when in fact SCPs only set account-wide permission boundaries and require additional IAM policies to enforce fine-grained restrictions.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) in AWS Organizations sets permissions boundaries for all accounts in the organization, but it cannot be used to restrict specific IAM users or groups within an account; it only defines the maximum allowed permissions for the entire account, and developers could still launch instances if the account-level permissions are not further restricted. Option B is wrong because AWS Config is a compliance and auditing service that can detect non-compliant instances and trigger remediation (e.g., termination), but it does not prevent the launch in real time; instances could be running and incurring costs before being terminated, and the termination itself might cause data loss or disruption. Option D is wrong because an S3 bucket policy controls access to S3 resources, not EC2 instance launches; it has no effect on the ec2:RunInstances API call and cannot restrict instance types.

Practice this question →
55
MCQmedium

A company is migrating a legacy application to AWS. The application requires a static IP address that can be used for whitelisting by third-party partners. The application will be deployed in multiple Availability Zones for high availability. The company wants to use a load balancer to distribute traffic. The solution must provide a single static IP address that does not change even if the underlying instances are replaced. Which combination of services should the company use?

A.Use an Application Load Balancer (ALB) with a static Elastic IP address attached to the ALB.
B.Use AWS Global Accelerator with an ALB as the endpoint.
C.Use Amazon CloudFront with an ALB as the origin.
D.Use a Network Load Balancer (NLB) with Elastic IP addresses assigned to each subnet.
AnswerD

NLBs support static IPs via Elastic IPs.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses by allowing you to assign Elastic IP addresses to each Availability Zone subnet. This provides a single static IP per AZ that does not change even when backend instances are replaced, meeting the requirement for a fixed whitelisting address across multiple AZs.

Exam trap

The trap here is that candidates often assume an ALB can have a static IP attached because it is a common load balancer, but ALBs are Layer 7 and inherently use dynamic IPs, while only NLBs (Layer 4) support Elastic IP assignment per subnet.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support attaching Elastic IP addresses directly; ALBs are assigned dynamic DNS names and cannot provide a static IP. Option B is wrong because AWS Global Accelerator provides static anycast IP addresses but uses an ALB as an endpoint, which still requires the ALB's DNS name and does not give the ALB itself a static IP; the static IPs are at the accelerator level, not the load balancer. Option C is wrong because Amazon CloudFront provides static IP addresses for edge locations, but the origin (ALB) still uses a dynamic DNS name and does not receive a static IP; CloudFront is a CDN, not a load balancer for direct traffic distribution.

Practice this question →
56
MCQmedium

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

A.The SCP only denies future API calls; it does not affect already running instances.
B.The SCP has a delay of up to 24 hours before it takes effect.
C.The SCP is not attached to the management account.
D.The SCP condition is incorrectly formatted; SCPs cannot evaluate instance types.
AnswerA

SCPs are preventive, not detective or corrective.

Why this answer

The most likely cause is that the SCP only denies future API calls, not already running instances. SCPs are evaluated at the time of the API request; any instances launched before the SCP was applied or before it was updated to include the deny condition will continue to run unaffected. The security team may be observing those pre-existing disallowed instances, not new launches.

Exam trap

The trap here is that candidates assume SCPs apply retroactively to existing resources, but AWS SCPs only affect future API actions, not the state of already-provisioned resources.

How to eliminate wrong answers

Option B is wrong because SCPs take effect within minutes, not up to 24 hours; there is no built-in propagation delay of that magnitude. Option C is wrong because SCPs are attached to OUs or accounts, not to the management account; the management account is exempt from SCPs by design. Option D is wrong because SCPs can absolutely evaluate instance types using conditions like ec2:InstanceType in the ec2:RunInstances action; the condition syntax is valid and commonly used.

Practice this question →
57
MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

A.Use cost allocation tags to tag resources with a department tag.
B.Use Amazon CloudWatch custom metrics to record department IDs.
C.Use service control policies (SCPs) to restrict costs per account.
D.Use AWS Budgets to create budgets per department.
AnswerA

Tags can be activated in AWS Cost Explorer to group costs.

Why this answer

Cost allocation tags allow you to tag AWS resources with metadata (e.g., department name) and then activate those tags in the AWS Billing and Cost Management console. Once activated, AWS generates cost reports that break down spending by those tags, enabling the finance team to map costs to each department's account. This is the native, recommended approach for cost attribution across accounts in AWS Organizations.

Exam trap

The trap here is that candidates confuse cost allocation tags with AWS Budgets or SCPs, mistakenly thinking that SCPs can limit costs or that Budgets can map costs, when in fact only tags provide the granular, reportable metadata needed for cost attribution.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch custom metrics are designed for monitoring operational performance (e.g., CPU utilization), not for tracking or attributing costs; they cannot be used to generate cost allocation reports. Option C is wrong because service control policies (SCPs) are used to centrally control permissions and enforce guardrails across accounts, not to restrict or track costs; they do not provide cost mapping or reporting capabilities. Option D is wrong because AWS Budgets allow you to set cost thresholds and receive alerts, but they do not provide a mechanism to map historical or granular costs to specific departments; they are a monitoring tool, not a cost attribution feature.

Practice this question →
58
MCQmedium

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

A.The resource ARN is incorrect.
B.The principal should be the CloudTrail service principal, not the root account of 111111111111.
C.The bucket policy requires the x-amz-acl header, which CloudTrail does not set.
D.The bucket policy does not allow s3:PutObject for the account 222222222222.
AnswerB

CloudTrail uses a service principal to write logs across accounts.

Why this answer

The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Exam trap

The trap here is that candidates often assume cross-account access requires the source account's root user as the principal, but AWS services like CloudTrail use service principals (e.g., `cloudtrail.amazonaws.com`) for cross-account log delivery, not IAM users or root accounts.

How to eliminate wrong answers

Option A is wrong because the resource ARN (arn:aws:s3:::bucket-name/*) is correctly formatted for an S3 bucket policy and would not cause a cross-account CloudTrail delivery failure if the principal were correct. Option C is wrong because CloudTrail does not require the `x-amz-acl` header; S3 bucket policies can grant access without ACLs, and CloudTrail uses the bucket policy to authorize writes. Option D is wrong because the bucket policy does allow `s3:PutObject` for the specified principal (the root of 111111111111), but the issue is that the principal is not the CloudTrail service principal, not that the action is missing.

Practice this question →
59
MCQmedium

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

A.Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.
B.Create a customer managed key in the backup account and share it with member accounts.
C.Grant the backup account full S3 access to member account buckets.
D.Enable AWS Config in member accounts to track backup compliance.
AnswerA

Cross-account role assumption is the standard pattern.

Why this answer

AWS Backup requires cross-account IAM roles to delegate backup and restore permissions. The central backup account assumes an IAM role in each member account that has a trust policy allowing the backup account's IAM entity to perform backup and restore actions. This is the minimal set of permissions needed to manage backups across accounts without granting broader access.

Exam trap

The trap here is that candidates often think sharing a KMS key or enabling a monitoring service like AWS Config is sufficient for cross-account backup permissions, but AWS Backup requires explicit IAM role delegation via sts:AssumeRole for the backup account to act in member accounts.

How to eliminate wrong answers

Option B is wrong because sharing a customer managed key (CMK) from the backup account to member accounts is not a permission for backup operations; it only enables encryption/decryption, and AWS Backup can use AWS managed keys or KMS key policies for cross-account encryption without requiring CMK sharing. Option C is wrong because granting full S3 access to member account buckets is excessive and not specific to AWS Backup; AWS Backup uses its own service-linked roles and does not require direct S3 access for backup operations. Option D is wrong because AWS Config tracks resource compliance but does not grant any permissions for backup or restore actions; it is a monitoring service, not an authorization mechanism.

Practice this question →
60
MCQmedium

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

A.Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.
B.Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.
C.Use S3 bucket policies with Deny statements for anonymous access and missing encryption.
D.Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.
AnswerB

SCPs centrally enforce restrictions across all accounts, covering all users including root.

Why this answer

AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all accounts in the organization without requiring per-account configuration. By creating SCPs that deny `s3:PutBucketPolicy` actions with an anonymous effect (using a condition key like `aws:SourceAccount` or inspecting the policy content) and deny `s3:PutObject` without the `x-amz-server-side-encryption-aws:kms` header, the security team ensures that no bucket can be made publicly accessible and no object can be uploaded without KMS encryption. This approach is the most efficient because it applies globally and proactively prevents non-compliant actions rather than detecting them after the fact.

Exam trap

The trap here is that candidates often choose reactive detective controls (like AWS Config with auto-remediation) because they seem comprehensive, but the question asks for the 'most efficient' way, which is a proactive preventive control using SCPs that blocks non-compliant actions before they happen.

How to eliminate wrong answers

Option A is wrong because IAM roles attached to users cannot prevent actions performed by services or roles that bypass user permissions, and managing roles in every account is not centralized or efficient. Option C is wrong because S3 bucket policies only apply to individual buckets and cannot enforce encryption on object uploads across all accounts; they also cannot prevent the creation of new buckets with permissive policies. Option D is wrong because AWS Config rules with auto-remediation are reactive—they detect violations after they occur and rely on Lambda functions to fix them, which is less efficient than proactively denying the actions via SCPs.

Practice this question →
61
MCQhard

A large e-commerce company uses a multi-account AWS Organizations setup with a central logging account. The company has enabled AWS CloudTrail in all accounts and configured it to deliver logs to a centralized Amazon S3 bucket in the logging account. Recently, the security team noticed that some log files are missing for a period of 2 hours. The CloudTrail console shows that trails are still enabled and delivering to the bucket, but no new log files were created during that time. The team verified that there were API calls made during that period. Which action is most likely to resolve the issue and prevent recurrence?

A.Review the SCPs attached to the organization root; there might be a policy that denies CloudTrail actions.
B.Check the S3 bucket policy in the logging account to ensure it grants the required permissions to the CloudTrail service principal from all accounts.
C.Ensure that the KMS key used for encryption is accessible by the CloudTrail service.
D.Enable AWS Config to monitor CloudTrail delivery status and automatically restart the trail if logs are missing.
AnswerB

If the bucket policy inadvertently denies access, CloudTrail cannot write logs.

Why this answer

The most likely cause is that the S3 bucket policy in the central logging account does not grant the necessary permissions for CloudTrail from all accounts to write log files. Even though trails are enabled and appear to be delivering, a missing or misconfigured bucket policy can silently drop log deliveries when the CloudTrail service principal (cloudtrail.amazonaws.com) attempts to write objects. The security team verified API calls occurred, so the issue is at the delivery destination, not the trail configuration itself.

Exam trap

The trap here is that candidates assume missing logs are always due to trail misconfiguration or KMS issues, but the real cause is often a missing or overly restrictive S3 bucket policy that silently blocks CloudTrail writes without generating an obvious error in the CloudTrail console.

How to eliminate wrong answers

Option A is wrong because SCPs deny actions at the account level, but CloudTrail trails are still enabled and delivering; if an SCP denied CloudTrail actions, the trail would fail to start or stop logging entirely, not selectively miss logs for a 2-hour window. Option C is wrong because if the KMS key were inaccessible, CloudTrail would log a failure event and typically stop delivering all logs until the issue is resolved, not just miss a 2-hour period while continuing to deliver before and after. Option D is wrong because AWS Config can monitor delivery status but cannot automatically restart a trail; it only provides compliance checks and notifications, and the trail is already enabled and delivering—restarting it would not fix a missing bucket policy permission.

Practice this question →
62
MCQeasy

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

A.Use an SCP to require that CloudTrail is enabled.
B.Use IAM policies in each account to deny the same actions.
C.Use AWS Config rules to detect and remediate changes.
D.Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.
AnswerD

SCPs can deny these sensitive actions across all accounts.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.

Exam trap

The trap here is that candidates often choose Option A (SCP to require CloudTrail) because they confuse 'requiring' a service with 'preventing its disablement,' but SCPs cannot enforce that a service is running—they can only deny API actions, making Option D the only effective preventive control.

How to eliminate wrong answers

Option A is wrong because an SCP that 'requires' CloudTrail to be enabled does not prevent disabling or deleting it after it is enabled; SCPs can only deny actions, not enforce a state or configuration. Option B is wrong because IAM policies in each account can be overridden by a user with sufficient privileges (e.g., an account admin) and do not provide a centralized, unchangeable guardrail across all accounts. Option C is wrong because AWS Config rules can detect and trigger remediation (e.g., via Lambda), but they are reactive and can be bypassed if the rule or remediation role is modified or if the change occurs faster than the remediation cycle; they do not prevent the action from happening in the first place.

Practice this question →
63
MCQmedium

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

A.Use AWS CloudFormation StackSets in each account.
B.Create an AWS Lambda function in the management account to enable Config rules.
C.Use an SCP to require Config recording.
D.Deploy an AWS Config conformance pack across accounts using AWS Organizations.
AnswerD

Conformance packs can be deployed to all accounts and regions via a single API call.

Why this answer

AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Exam trap

The trap here is that candidates often confuse SCPs with direct resource configuration, thinking they can enforce Config rules via permission boundaries, but SCPs only control API calls and cannot enable services or rules themselves.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets require manual setup or automation to target new accounts; they do not automatically apply to new member accounts unless you update the stack set instances or use automatic deployment, which is not a native feature of StackSets alone. Option B is wrong because creating an AWS Lambda function in the management account to enable Config rules would require custom code to detect new accounts and apply rules, and it does not leverage AWS Organizations' native integration for automatic propagation. Option C is wrong because Service Control Policies (SCPs) are used to restrict permissions and cannot directly enable AWS Config rules or recording; they only control what actions are allowed or denied.

Practice this question →
64
MCQmedium

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

A.Use AWS CloudFormation StackSets to deploy a bucket template with tags.
B.Use IAM policies in each account to require tags on bucket creation.
C.Use a Service Control Policy (SCP) in AWS Organizations that denies s3:CreateBucket if the request does not include the required tags.
D.Use AWS Config rules to automatically tag buckets after creation.
AnswerC

SCPs prevent the action at the account level.

Why this answer

A Service Control Policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action if the request does not include the required tags (cost center and environment). SCPs apply to all accounts in the organization, enforcing the tagging requirement at the API level before the bucket is created, which is the most effective preventive control.

Exam trap

The trap here is that candidates often choose a reactive solution like AWS Config (Option D) because it can tag buckets, but they miss that the question requires enforcement at creation time, which only a preventive control like an SCP can achieve.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy a bucket template with tags, but they do not enforce tagging on buckets created outside of that template (e.g., via the console, CLI, or SDK). Option B is wrong because IAM policies in each account can require tags, but they are not centrally managed and can be overridden by account administrators; also, IAM policies cannot enforce tags on the s3:CreateBucket action because the condition key for tags (aws:RequestTag) is not evaluated for all services in the same way. Option D is wrong because AWS Config rules can detect and tag buckets after creation (reactive), but they do not prevent untagged buckets from being created, which violates the security team's requirement to enforce tagging automatically at creation time.

Practice this question →
65
MCQeasy

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

A.A VPC peering connection between the accounts
B.An IAM role in the production account with a trust policy allowing the development account
C.A service control policy (SCP) that permits AssumeRole
D.An AWS Config rule to validate the role
AnswerB

Trust policies enable cross-account role assumption.

Why this answer

Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.

Exam trap

The trap here is confusing network connectivity (VPC peering) with IAM authorization, or assuming that an SCP alone can enable cross-account access when SCPs only act as a permission guardrail within an organization.

How to eliminate wrong answers

Option A is wrong because VPC peering connects networks at Layer 3 and does not provide any IAM-based authentication or authorization for cross-account role assumption. Option C is wrong because SCPs can only deny or allow permissions for principals within the same organization; they cannot grant cross-account access or replace the need for a trust policy on the target role. Option D is wrong because AWS Config rules evaluate resource compliance after the fact and do not enable or control the ability to assume a role across accounts.

Practice this question →
66
MCQmedium

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

A.The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.
B.The role requires MFA, but the user's MFA device is not configured correctly.
C.The user is not passing the MFA serial number and token code in the assume-role API call.
D.The principal is set to the root account, which does not allow IAM users to assume the role.
AnswerC

Even if MFA is enabled, the user must provide serial number and token code in the STS AssumeRole call.

Why this answer

The IAM role trust policy includes a condition that checks for the presence of both `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge`. Even though the user has MFA enabled and is passing the MFA token, the `aws:MultiFactorAuthSerialNumber` and `aws:MultiFactorAuthTokenCode` parameters must be explicitly included in the `sts:AssumeRole` API call. Without these, the condition evaluates to false, resulting in an 'AccessDenied' error.

Exam trap

The trap here is that candidates often assume that simply having MFA enabled and passing the token in the session is sufficient, but the `sts:AssumeRole` API call requires the MFA serial number and token code to be explicitly provided as parameters, which is a common oversight in programmatic role assumption scenarios.

How to eliminate wrong answers

Option A is wrong because `BoolIfExists` is a valid condition operator that returns true if the key exists and matches the value, or if the key is absent (missing). In this case, the condition uses `BoolIfExists` correctly to allow the role to be assumed when MFA is present; the failure is not due to the operator choice. Option B is wrong because the user has MFA enabled and is passing the MFA token, so the MFA device is configured correctly; the issue is that the MFA serial number and token code are not being passed in the API call.

Option D is wrong because setting the principal to the root account (the account ID) allows any IAM user in that account to assume the role, provided they meet the conditions; the root principal does not inherently block IAM users.

Practice this question →
67
MCQmedium

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

A.A service control policy in account 222222222222 is denying the sts:AssumeRole action
B.The role is not in the same region as the user
C.The trust policy only allows the root user, not individual users
D.The trust policy is malformed
AnswerC

The principal is the root user ARN; individual users need a separate ARN or permissions.

Why this answer

The trust policy explicitly allows only the root user of account 111111111111 (arn:aws:iam::111111111111:root) to assume the role. Individual IAM users within that account are not granted permission unless the trust policy includes the specific user ARN or a condition that allows federated access. Since the user is not the root user, the sts:AssumeRole call fails due to the principal restriction in the trust policy.

Exam trap

The trap here is that candidates often confuse the root user ARN (which represents the account but only grants access to the root user) with allowing all IAM users in the account, leading them to overlook the need to specify individual user ARNs or use a condition for broader access.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) in account 222222222222 would affect all principals in that account, but the issue is that the user in account 111111111111 cannot assume the role; SCPs do not block cross-account assume role calls from an external account. Option B is wrong because IAM roles and users are global resources; region does not affect the ability to assume a role via the global STS endpoint. Option D is wrong because the trust policy is not malformed; it is syntactically valid but overly restrictive by only allowing the root user principal.

Practice this question →
68
Multi-Selecteasy

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

Select 2 answers
A.AWS CloudTrail
B.AWS Organizations SCPs
C.AWS CloudFormation StackSets
D.Amazon VPC Flow Logs
E.AWS Config rules
AnswersB, E

SCPs can deny or allow actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) allow you to centrally control the maximum available permissions for all accounts, enabling automated enforcement of compliance policies by restricting actions across multiple accounts without per-account configuration. AWS Config rules allow you to define rules that evaluate resource configurations against desired policies and can trigger automatic remediation actions, enforcing compliance across accounts when integrated with AWS Organizations.

Exam trap

The trap here is that candidates often confuse monitoring services (CloudTrail, VPC Flow Logs) with enforcement services, or assume that infrastructure deployment tools (CloudFormation StackSets) inherently enforce compliance, when in fact they only provision resources without policy enforcement.

Practice this question →
69
MCQmedium

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

A.The policy denies all instance types except t3.micro and t3.small.
B.The policy has a syntax error that causes all actions to be denied.
C.The policy does not explicitly allow ec2:RunInstances.
D.The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.
AnswerA

The condition denies if the instance type is not in the list.

Why this answer

The IAM policy includes a Deny statement that explicitly denies ec2:RunInstances for any instance type that is not t3.micro or t3.small. Since the developer is attempting to launch a t3.medium instance, which is not listed in the allowed types, the Deny statement matches and overrides any Allow, resulting in an AccessDenied error. This is the most likely reason because explicit Deny always takes precedence over Allow in IAM policy evaluation logic.

Exam trap

The trap here is that candidates may overlook the explicit Deny statement and assume the error is due to a missing Allow, but AWS IAM requires both an Allow and no matching Deny for the action to succeed, and the Deny here is the direct cause of the failure.

How to eliminate wrong answers

Option B is wrong because a syntax error in an IAM policy would cause the policy to be invalid and not saved or attached; AWS validates policy syntax before attachment, so a syntax error would not silently deny actions. Option C is wrong because the policy does explicitly allow ec2:RunInstances in the Allow statement (for t3.micro and t3.small), so the developer is not denied due to a missing Allow. Option D is wrong because the policy does not reference any AMI condition; the Deny is based solely on instance type, not on the AMI used.

Practice this question →
70
MCQhard

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

A.Use AWS Config rules to detect users without MFA and send alerts.
B.Use AWS CloudTrail to monitor and disable users without MFA.
C.Set an IAM password policy that requires MFA for all users.
D.Apply an SCP that denies all actions if the principal does not have MFA.
AnswerD

Forces MFA for all API calls.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config alerts) with preventive controls (like SCPs), or mistakenly think IAM password policies can enforce MFA, when in fact password policies only govern password characteristics, not multi-factor authentication.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect users without MFA and send alerts, but they cannot enforce MFA or block actions. Option B is wrong because AWS CloudTrail is a logging service that records API calls; it cannot disable users or enforce MFA, and monitoring alone does not prevent non-compliant actions. Option C is wrong because an IAM password policy cannot require MFA for all users; password policies control password complexity, rotation, and reuse, but MFA enforcement must be done via IAM policies or SCPs, not password policies.

Practice this question →
71
MCQmedium

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

A.Apply an SCP to enable AWS Config in all accounts.
B.Use CloudFormation StackSets to deploy Config rules, then view in each account.
C.Enable AWS Config in the security account only and use cross-account roles.
D.Enable AWS Config in each account and use an aggregator in the security account.
AnswerD

Aggregator collects compliance data from multiple accounts.

Why this answer

AWS Config must be enabled in each individual account to record resource configurations and evaluate rules. An aggregator in the security account can then collect compliance data from all accounts, enabling centralized viewing and management of Config rules without needing to log into each account separately.

Exam trap

The trap here is that candidates assume a single Config instance in a central account can monitor all other accounts via cross-account roles, but AWS Config is account-scoped and must be enabled in each account to record its own resources.

How to eliminate wrong answers

Option A is wrong because SCPs (Service Control Policies) can only restrict or deny permissions; they cannot enable a service like AWS Config in accounts. Option B is wrong because CloudFormation StackSets can deploy Config rules across accounts, but without Config being enabled in each account first, the rules have no configuration recorder to evaluate against, and compliance cannot be viewed centrally without an aggregator. Option C is wrong because enabling AWS Config only in the security account would only record resources in that account; cross-account roles allow access but do not enable Config recording or rule evaluation in other accounts.

Practice this question →
72
MCQhard

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

A.The GuardDuty detector in the management account is not configured to publish findings to S3.
B.GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.
C.The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.
D.Each member account must individually configure the S3 bucket as a publishing destination for its own findings.
AnswerD

Each account must set up its own publishing destination.

Why this answer

For GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place.

Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Practice this question →
73
MCQeasy

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?

A.Amazon Cognito user pools
B.AWS Organizations
C.AWS Identity and Access Management (IAM)
D.AWS IAM Identity Center (AWS SSO) with an AWS Managed Microsoft AD directory
AnswerD

Integrates with on-premises AD via AD Connector or managed AD.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) can be integrated with an AWS Managed Microsoft AD directory to provide a single sign-on experience across multiple AWS accounts and business applications. This integration allows users to authenticate using their existing on-premises Active Directory credentials via AD Connector or a two-way forest trust, enabling seamless access to the AWS Management Console, command-line interface, and supported SAML 2.0 applications.

Exam trap

The trap here is that candidates often confuse AWS IAM Identity Center with AWS IAM, assuming IAM alone can provide SSO across multiple accounts, but IAM is account-scoped and lacks the centralized application portal and cross-account federation capabilities that IAM Identity Center provides.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito user pools are designed for customer-facing identity and access management, not for integrating with an existing on-premises Microsoft Active Directory for employee SSO across multiple AWS accounts. Option B is wrong because AWS Organizations is a service for centrally managing and governing multiple AWS accounts, not for providing identity federation or SSO capabilities. Option C is wrong because AWS IAM is used for managing permissions for individual AWS users and roles, but it does not natively support SSO integration with on-premises Active Directory or provide a centralized portal for accessing multiple AWS accounts and business applications.

Practice this question →
74
MCQeasy

A company wants to centrally manage backups for Amazon EBS volumes across multiple AWS accounts. They need a solution that can automatically back up volumes based on tags, retain backups according to a policy, and send notifications on failures. Which AWS service should they use?

A.AWS CloudFormation StackSets
B.Amazon RDS automated backups
C.AWS Backup
D.Amazon S3 lifecycle policies
AnswerC

AWS Backup provides centralized backup management across accounts.

Why this answer

AWS Backup is the correct service because it provides a centralized, policy-based backup solution for Amazon EBS volumes across multiple AWS accounts. It supports tag-based backup policies, retention rules, and integrates with Amazon CloudWatch Events and Amazon SNS to send notifications on failures, meeting all the stated requirements.

Exam trap

The trap here is that candidates might confuse AWS Backup with native snapshot management or assume that a service like CloudFormation StackSets can handle backup automation, but only AWS Backup provides the centralized, policy-driven, cross-account backup management with notification capabilities required by the scenario.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets is used to deploy infrastructure as code across multiple accounts and regions, not for managing backups or retention policies. Option B is wrong because Amazon RDS automated backups are specific to RDS databases and cannot back up EBS volumes or operate across multiple accounts. Option D is wrong because Amazon S3 lifecycle policies manage the transition and expiration of objects within S3 buckets, not the backup of EBS volumes.

Practice this question →
75
MCQmedium

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

A.An IAM policy must be attached to the role granting permissions to the S3 bucket
B.A service control policy must allow Lambda to assume roles
C.The S3 bucket must have a resource-based policy allowing the Lambda function
D.The trust policy must specify the Lambda function name
AnswerA

The trust policy allows Lambda to assume the role, but the role itself needs an IAM policy to grant S3 access.

Why this answer

The IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Exam trap

The trap here is that candidates often confuse the trust policy (which controls who can assume the role) with the permissions policy (which controls what actions the role can perform), leading them to think the trust policy alone is sufficient for accessing resources.

How to eliminate wrong answers

Option B is wrong because service control policies (SCPs) are used in AWS Organizations to restrict permissions for accounts, not to allow Lambda to assume roles; SCPs can only deny or allow permissions, but they do not grant the ability to assume roles—that is handled by IAM trust policies. Option C is wrong because the S3 bucket resource-based policy is not required when the Lambda function and the bucket are in the same account; in the same account, IAM roles alone can grant access without needing a bucket policy. Option D is wrong because the trust policy does not need to specify the Lambda function name; it only needs to specify the AWS service principal (lambda.amazonaws.com) to allow the Lambda service to assume the role on behalf of any function in the account.

Practice this question →
Page 1 of 6 · 432 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Design Solutions for Organizational Complexity questions.

Start 20-question session