CCNA Design Solutions for Organizational Complexity Questions — Page 6 of 6

376

MCQeasy

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

A.Configure VPC Flow Logs to deliver to an S3 bucket in each account, then enable S3 Cross-Region Replication to the central bucket in the logging account.

B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

C.Create a Lambda function in each account that copies log files to the central bucket.

D.Use S3 Batch Operations to copy logs from each account to the central bucket daily.

AnswerA

S3 replication is serverless, cost-effective, and scales automatically.

Why this answer

VPC Flow Logs can be delivered directly to an S3 bucket in each account, and S3 Cross-Region Replication (CRR) can then automatically and asynchronously replicate the logs to a centralized bucket in the logging account. This approach is highly scalable (CRR handles replication without any custom code or infrastructure) and cost-effective (no additional compute or streaming services are needed; you only pay for S3 storage and replication costs).

Exam trap

The trap here is that candidates often assume Kinesis Data Firehose is the most scalable streaming solution, but for VPC Flow Logs delivered to S3, direct S3 delivery with CRR is simpler, more cost-effective, and avoids unnecessary streaming costs and complexity.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose introduces additional per-GB ingestion and processing costs, and requires managing delivery streams in each account, making it less cost-effective and more complex than direct S3 delivery with CRR. Option C is wrong because using a Lambda function in each account to copy log files introduces cold starts, concurrency limits, and additional compute costs, and does not scale as well as S3's built-in replication for high-volume logs. Option D is wrong because S3 Batch Operations is designed for one-time or periodic bulk actions (e.g., copying existing objects), not for continuous, real-time replication of streaming VPC Flow Logs, and it would require manual scheduling and additional orchestration.

Practice this question →

377

MCQeasy

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

A.Use AWS Client VPN to connect each account to the central VPC.

B.Use VPC Peering between the central VPC and each member account VPC.

C.Use AWS Direct Connect between accounts.

D.Use AWS Transit Gateway with VPN attachments between the central networking account and each member account VPC.

AnswerD

Provides IPsec encryption and centralized routing.

Why this answer

AWS Transit Gateway with VPN attachments enables encrypted traffic between the central networking account and each member account VPC using IPsec tunnels. This satisfies the encryption-in-transit requirement while ensuring all traffic routes through the central networking account, preventing direct account-to-account access. Transit Gateway also allows all accounts to share a single VPC for workloads without creating separate VPCs.

Exam trap

The trap here is that candidates may assume VPC Peering or Direct Connect inherently meet encryption requirements, but VPC Peering does not encrypt traffic and Direct Connect requires an additional VPN layer for encryption, while Transit Gateway VPN attachments provide both encryption and centralized routing control.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN provides encrypted client-to-VPN access but is designed for individual user connections, not for routing traffic between VPCs or accounts, and it does not enforce that all inter-account traffic must go through the central networking account. Option B is wrong because VPC Peering does not natively encrypt traffic in transit; it relies on AWS's physical network security but does not meet explicit encryption requirements, and it allows direct peering relationships that could bypass the central networking account. Option C is wrong because AWS Direct Connect provides a dedicated private connection from on-premises to AWS, not between accounts, and it does not inherently encrypt traffic unless combined with IPsec VPN, which is not specified in the option.

Practice this question →

378

MCQhard

Refer to the exhibit. A security engineer ran this AWS CLI command to investigate who created a CloudTrail trail in January 2024. The command returned no results. However, the security team knows that a trail was created during that period. What is the most likely reason for the empty result?

A.The start time is too far in the past and CloudTrail only retains events for 90 days.

B.The trail was created using the AWS Management Console, not the CLI.

C.The trail was created in a different region and the command did not specify a region.

D.The command syntax is incorrect; the --lookup-attributes parameter should be --attribute.

AnswerC

By default, the CLI uses the current region; the trail might be in another region.

Why this answer

The AWS CLI command `aws cloudtrail lookup-events` defaults to the region configured in the AWS CLI profile (e.g., `us-east-1`). If the CloudTrail trail was created in a different region, the command will return no results unless the `--region` parameter is explicitly specified. Since the security team knows the trail was created in January 2024, the most likely reason for the empty result is that the command did not target the correct region.

Exam trap

The trap here is that candidates assume CloudTrail events are globally visible by default, but `lookup-events` is region-scoped unless the trail is a multi-region trail, and even then, the command must be run in the home region of the trail to see the creation event.

How to eliminate wrong answers

Option A is wrong because CloudTrail `lookup-events` can retrieve events for up to 90 days, but the command can also access events beyond that if the trail is configured to send events to CloudWatch Logs or S3, and the `--lookup-attributes` parameter does not impose a 90-day limit on the API itself. Option B is wrong because the method of creation (Console vs. CLI) does not affect the ability of `lookup-events` to retrieve the event; CloudTrail records all management events regardless of the interface used.

Option D is wrong because the `--lookup-attributes` parameter is the correct syntax for the `lookup-events` command; there is no `--attribute` parameter in the AWS CLI for CloudTrail.

Practice this question →

379

MCQhard

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

A.Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present

B.Use AWS Config rules to remediate non-compliant objects

C.Require users to use pre-signed URLs for uploads

D.Attach an SCP that denies s3:PutObject without encryption

AnswerA

Bucket policies can enforce encryption at upload time.

Why this answer

An S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Exam trap

The trap here is that candidates often choose AWS Config (Option B) thinking it can enforce encryption, but Config is detective and reactive, not preventive, whereas a bucket policy with a deny condition is the only way to block unencrypted uploads at the API level.

How to eliminate wrong answers

Option B is wrong because AWS Config rules are reactive, not preventive; they can detect non-compliant objects after upload and trigger remediation (e.g., copying the object with encryption), but they do not block the initial unencrypted write, leaving a window where data is stored without encryption. Option C is wrong because pre-signed URLs control access duration and permissions but do not enforce encryption headers; a pre-signed URL for s3:PutObject can be used to upload unencrypted data unless the bucket policy explicitly denies such requests. Option D is wrong because Service Control Policies (SCPs) apply to all IAM principals in an AWS Organizations account but cannot enforce object-level encryption headers; SCPs can deny actions based on conditions, but the condition for encryption headers (e.g., s3:x-amz-server-side-encryption) is not supported in SCPs, making this option ineffective.

Practice this question →

380

Multi-Selecthard

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Select 2 answers

A.Create an SCP that denies the ec2:RunInstances action for specific instance types.

B.Use AWS Config rules to detect non-compliant instance types and automatically terminate them using AWS Systems Manager Automation.

C.Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

D.Use Service Quotas to restrict the number of instances of specific types.

E.Create an IAM policy in each account that denies the specified instance types.

AnswersA, B

SCPs can deny actions based on condition keys like ec2:InstanceType.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config, CloudTrail) with preventive controls (SCPs), or they assume IAM policies can be centrally managed across accounts, when in fact SCPs are the only native mechanism for organization-wide preventive restrictions.

Practice this question →

381

MCQmedium

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

A.Create an IAM role in the source account and have the user assume it.

B.Update the bucket policy to allow the user's ARN directly.

C.Attach an IAM policy to the user that allows s3:GetObject on the bucket.

D.Use a bucket ACL to grant access to the user's canonical ID.

AnswerC

Since the bucket policy trusts the account, the user just needs IAM permissions.

Why this answer

The simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Exam trap

The trap here is that candidates often overcomplicate cross-account access by assuming a role or modifying the bucket policy, when the simplest solution is to use an IAM policy on the user because the bucket policy already authorizes the account's root user.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in the source account and having the user assume it introduces unnecessary complexity; the bucket policy already allows the account's root user, so a simple IAM policy on the user suffices. Option B is wrong because updating the bucket policy to allow the user's ARN directly is not the simplest approach and would require modifying the bucket policy, which is more complex than attaching an IAM policy to the user. Option D is wrong because bucket ACLs are legacy and do not support granting access to IAM users directly; they only grant access to AWS accounts or canonical IDs, not individual IAM users.

Practice this question →

382

MCQmedium

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

A.Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.

B.Enable AWS Config in the management account and use an aggregator for all accounts.

C.Use an SCP to automatically enable the AWS Config rule in all accounts.

D.Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

AnswerA

Correct. CloudFormation StackSets can deploy the Config rule to all accounts, and with automatic deployment, new accounts automatically receive it, offering the least operational overhead for this requirement.

Why this answer

AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule.

Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Exam trap

The trap here is that candidates may think SCPs can enforce configuration standards, but SCPs only control API actions and cannot create or enable resources like Config rules. The correct approach is to use a deployment mechanism such as CloudFormation StackSets to automatically deploy the rule across accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets require manual setup and ongoing maintenance to deploy to new accounts as they are added, which adds operational overhead compared to a policy-based approach. Option B is wrong because enabling AWS Config in the management account and using an aggregator only centralizes compliance data; it does not enforce the Config rule in new accounts automatically. Option C is wrong because SCPs cannot directly enable AWS Config rules; they can only deny or allow API actions, not create or configure AWS resources.

Practice this question →

383

MCQmedium

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

A.Use AWS Config to detect and delete untagged VPCs.

B.Use IAM policies in each account to require tags.

C.Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.

D.Use AWS CloudFormation StackSets to deploy VPC templates with tags.

AnswerC

Prevents creation at the organization level.

Why this answer

AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.

Exam trap

The trap here is that candidates often confuse AWS Config's detective capabilities with preventive controls, or assume IAM policies in individual accounts can be centrally enforced, when only SCPs provide organization-wide preventive enforcement that cannot be bypassed by account-level administrators.

How to eliminate wrong answers

Option A is wrong because AWS Config can detect and report untagged VPCs, but it cannot prevent their creation; it only provides post-hoc compliance evaluation and can trigger remediation, not enforce the tag at creation time. Option B is wrong because IAM policies in each account can require tags, but they are managed per-account and cannot be enforced centrally across all accounts in the organization; a user with sufficient permissions in their own account could modify or remove the IAM policy. Option D is wrong because AWS CloudFormation StackSets can deploy VPC templates with tags, but they do not prevent users from creating VPCs outside of CloudFormation using the console, CLI, or SDK, so they do not enforce the tag requirement.

Practice this question →

384

MCQmedium

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

A.Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

B.Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.

C.Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

D.Place a network load balancer in each VPC and capture traffic using a packet sniffer.

AnswerB

Scalable and cost-effective.

Why this answer

VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Exam trap

The trap here is that candidates may over-engineer the solution by choosing Traffic Mirroring or NLB-based packet capture, thinking full packet inspection is needed, when metadata from Flow Logs is sufficient for security analysis and far more cost-effective at scale.

How to eliminate wrong answers

Option A is wrong because Traffic Mirroring copies full packet contents to a central appliance, which incurs high data transfer and processing costs, and requires managing a separate inspection instance that does not scale elastically. Option C is wrong because streaming Flow Logs to CloudWatch Logs in each account creates a decentralized, harder-to-query setup with higher per-log ingestion and storage costs, and lacks a single pane of glass for cross-account analysis. Option D is wrong because placing a Network Load Balancer in each VPC does not inherently capture traffic; packet sniffers require agent installation and cannot capture all traffic without significant performance overhead and architectural complexity.

Practice this question →

385

MCQeasy

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

A.AWS Directory Service for Microsoft Active Directory.

B.Amazon Cognito user pools.

C.AWS IAM Identity Center.

D.AWS Identity and Access Management (IAM) with SAML federation.

AnswerC

IAM Identity Center integrates with SAML 2.0 IdPs and provides SSO across multiple AWS accounts.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Exam trap

The trap here is that candidates often confuse IAM SAML federation (which works for a single account) with IAM Identity Center (which is the correct multi-account SSO solution), leading them to select Option D because they know SAML 2.0 is supported, but they miss the requirement for multiple AWS accounts.

How to eliminate wrong answers

Option A is wrong because AWS Directory Service for Microsoft Active Directory is a managed AD service that supports SAML federation but is designed for integrating with Microsoft AD workloads, not as a general-purpose SAML IdP broker for multiple AWS accounts; it would require additional configuration with IAM roles and does not natively manage cross-account permissions sets. Option B is wrong because Amazon Cognito user pools are intended for customer-facing identity and access management in applications, not for workforce SSO to AWS accounts; they lack the ability to assign permissions sets across multiple AWS accounts. Option D is wrong because IAM with SAML federation allows you to federate a single IdP into a single AWS account, but it does not provide centralized management across multiple accounts; you would need to manually configure roles and trust policies in each account, which is not scalable for multi-account SSO.

Practice this question →

386

Multi-Selecthard

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

Select 3 answers

A.Create an AWS Glue table or use Athena's CREATE TABLE statement to define the schema of the Flow Logs.

B.Ensure the Flow Logs are delivered in GZIP format (default) or uncompressed.

C.Deliver VPC Flow Logs from each account to a centralized S3 bucket in the logging account.

D.Replicate the S3 bucket to a single AWS Region for consistency.

E.Configure a Kinesis Data Firehose delivery stream to convert Flow Logs to Parquet format.

AnswersA, B, C

Athena needs a table definition to query the data.

Why this answer

Athena requires a schema definition to query data in S3. You can either create an AWS Glue table (which is a managed schema catalog) or use Athena's CREATE TABLE statement to define the schema for VPC Flow Logs, including fields like version, account-id, interface-id, srcaddr, dstaddr, etc. Without this schema, Athena cannot parse the raw flow log data.

Exam trap

The trap here is that candidates may think converting to Parquet or replicating across regions is mandatory, but AWS allows direct querying of GZIP text files in a single centralized S3 bucket without additional transformation or replication.

Practice this question →

387

MCQeasy

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

A.Amazon S3 bucket with cross-account bucket policy

B.Amazon Kinesis Data Firehose delivery stream with cross-account access

C.Amazon CloudWatch Logs subscription filter

D.AWS Lambda function in each account that sends logs to a central API

AnswerB

Firehose can accept data from multiple accounts via IAM roles and deliver to a central OpenSearch domain.

Why this answer

Amazon Kinesis Data Firehose can be configured with cross-account access by using a resource-based policy on the delivery stream that grants permissions to other AWS accounts to write log data directly. This allows logs from multiple accounts to be sent to a single Firehose delivery stream in the central account, which then delivers the logs to the OpenSearch Service domain. The cross-account capability is essential for aggregating logs without requiring intermediate storage or complex custom solutions.

Exam trap

The trap here is that candidates often assume CloudWatch Logs subscription filters (Option C) can natively forward logs across accounts, but they cannot; they require additional cross-account mechanisms like a Lambda function or Firehose with proper permissions, making Firehose the correct managed service for this centralized logging scenario.

How to eliminate wrong answers

Option A is wrong because an Amazon S3 bucket with a cross-account bucket policy can store logs from multiple accounts, but it does not actively collect and forward logs to OpenSearch Service; it is a passive storage destination and would require additional services (e.g., Lambda or Firehose) to ingest into OpenSearch. Option C is wrong because a CloudWatch Logs subscription filter can forward logs to a single destination like Firehose or Lambda, but it operates within the same account only; cross-account subscription filters are not supported natively without additional infrastructure (e.g., cross-account Lambda). Option D is wrong because using a Lambda function in each account to send logs to a central API introduces unnecessary complexity, potential latency, and single points of failure, and is not a managed, scalable service designed for this purpose; it also requires custom code and error handling.

Practice this question →

388

Multi-Selectmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

Select 2 answers

A.Create an IAM role in each account that requires CloudTrail to be enabled

B.Use CloudFormation StackSets to deploy a CloudTrail trail in each account

C.Use AWS Config rules to detect when CloudTrail is not configured correctly and trigger remediation

D.Use AWS Lambda to automatically re-enable CloudTrail if it is disabled

E.Use a service control policy (SCP) to deny actions that disable CloudTrail or modify the trail configuration

AnswersC, E

Config rules can monitor and auto-remediate to ensure compliance.

Why this answer

AWS Config rules can be used to continuously monitor CloudTrail configuration across accounts and automatically trigger remediation actions (e.g., via AWS Systems Manager Automation or Lambda) when non-compliance is detected. This ensures that any drift from the required CloudTrail setup is corrected without manual intervention, providing a detective and corrective control. Option E is correct because a service control policy (SCP) can deny the cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions at the organizational level, preventing any account from disabling or modifying the central CloudTrail trail, thus enforcing the required configuration proactively.

Exam trap

The trap here is that candidates often confuse initial deployment (CloudFormation StackSets) with ongoing enforcement, or they mistakenly believe that a reactive Lambda function is sufficient for compliance, failing to recognize that SCPs and Config rules provide the necessary preventive and detective controls required by the security team's goal of ensuring all accounts use CloudTrail with logs delivered to a central S3 bucket.

Practice this question →

389

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

A.Use AWS CloudTrail to monitor and alert on unencrypted buckets

B.Enable S3 default encryption in each account

C.Apply a service control policy (SCP) that denies creation of S3 buckets without encryption

D.Use S3 bucket policies to require encryption

AnswerC

SCP can be applied to the entire organization or OU to enforce encryption at account creation.

Why this answer

A service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Exam trap

The trap here is that candidates often confuse S3 bucket policies (which control access to objects) with SCPs (which control API actions at the account level), leading them to choose option D, which cannot enforce encryption on the bucket itself.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail only provides logging and monitoring capabilities; it cannot proactively enforce or prevent the creation of unencrypted buckets, only alert after the fact. Option B is wrong because enabling S3 default encryption in each account relies on individual account administrators to configure it correctly, and it does not prevent users from explicitly overriding the default during bucket creation. Option D is wrong because S3 bucket policies can require encryption for objects uploaded to a bucket, but they do not enforce encryption on the bucket itself (i.e., the bucket's default encryption setting) and cannot prevent the creation of a bucket without encryption enabled.

Practice this question →

390

MCQhard

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

A.Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.

B.Use AWS Config to detect non-compliant AMIs and stop the instances.

C.Create a service catalog product for EC2 with allowed AMIs.

D.Use AWS Systems Manager to enforce AMI compliance.

AnswerA

SCP applies to all accounts in the organization.

Why this answer

An SCP applied at the root or OU level can deny ec2:RunInstances unless the ec2:ImageId matches a specific set of allowed AMIs. This scales to 500 accounts without per-account configuration, as SCPs are inherited by all accounts in the organization. The condition key ec2:ImageId supports wildcard patterns or a list of AMI IDs, making it a centralized, preventive control.

Exam trap

The trap here is that candidates confuse detective controls (AWS Config) with preventive controls (SCPs), assuming detection and remediation are as scalable as prevention, but SCPs block the action before it happens, which is the most scalable and least disruptive approach for 500 accounts.

How to eliminate wrong answers

Option B is wrong because AWS Config is detective, not preventive; it can detect non-compliant AMIs after launch and trigger a remediation (e.g., stop instances), but it does not prevent the initial launch, and stopping instances is disruptive and less scalable. Option C is wrong because Service Catalog provides a curated product list but does not enforce that users must use it; users can still launch EC2 instances outside Service Catalog via the console or API, so it is not a scalable enforcement mechanism. Option D is wrong because AWS Systems Manager is an operations management service that can patch or remediate instances after launch, but it cannot prevent the initial launch of a non-compliant AMI; it is reactive, not preventive.

Practice this question →

391

Multi-Selecthard

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

Select 3 answers

A.Configure S3 bucket policies in each account to enforce encryption using the KMS key.

B.Configure S3 buckets in each account to use the shared KMS key for server-side encryption.

C.Create a customer managed KMS key in the security account and share it with the other accounts using AWS Resource Access Manager (RAM).

D.Create IAM users in the security account and grant them access to the KMS key.

E.Apply a service control policy (SCP) that denies s3:PutObject unless the request uses the required KMS key.

AnswersB, C, E

Buckets must be configured to use the shared key for encryption.

Why this answer

Configuring S3 buckets to use the shared KMS key for server-side encryption (SSE-KMS) ensures that all objects written to the bucket are encrypted at rest with the centralized key. Option C is correct because the KMS key must be created in the security account and shared via AWS RAM to allow other accounts to use it for encryption. Option E is correct because a service control policy (SCP) can be applied to deny s3:PutObject unless the request includes the required KMS key, providing an additional enforcement layer.

Together, these steps enforce centralized encryption across accounts.

Exam trap

The trap here is that candidates often confuse S3 bucket policies with default encryption settings, thinking a bucket policy can enforce a specific KMS key ARN, when in reality bucket policies can only check for the presence of encryption headers or a key ID via condition keys, not enforce the exact key used for encryption.

Practice this question →

392

MCQeasy

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

A.Create a Transit Gateway and attach all accounts.

B.Set up a VPN connection between accounts.

C.Use AWS RAM to share the subnet with the organization.

D.Create a VPC peering connection between each account and the VPC owner.

AnswerC

RAM allows sharing subnets with accounts in the organization.

Why this answer

AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Exam trap

The trap here is that candidates often confuse network connectivity solutions (Transit Gateway, VPC peering, VPN) with resource sharing, assuming that to 'share' a subnet you must connect the VPCs, when in fact AWS RAM provides a direct, secure, and managed way to share subnets without any network-level interconnection.

How to eliminate wrong answers

Option A is wrong because a Transit Gateway is a network transit hub used to interconnect VPCs and on-premises networks, not a mechanism to share a subnet; attaching accounts via Transit Gateway would require separate VPCs and routing, not direct subnet sharing. Option B is wrong because a VPN connection between accounts would create an encrypted tunnel over the internet, which is unnecessary overhead and introduces latency and complexity for sharing a subnet that should be accessed natively within the same AWS backbone. Option D is wrong because VPC peering connects entire VPCs, not individual subnets, and requires managing multiple peering connections and route tables; it also does not allow the peered accounts to launch resources directly into the owner's subnet.

Practice this question →

393

MCQeasy

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

A.Deploy AWS CloudFormation StackSets to each account with security templates.

B.Create a shared services account and use IAM cross-account roles for each business unit.

C.Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.

D.Migrate all workloads to a single AWS account and use IAM roles for each business unit.

AnswerC

SCPs enforce policies across all accounts while OUs allow delegation.

Why this answer

AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs remove all administrative control, when in fact SCPs only set upper permission boundaries and allow business units to retain full administrative autonomy within those limits.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets deploy resources and templates but do not enforce ongoing security policies; business units could modify or delete the deployed resources, and StackSets lack the ability to set permission guardrails. Option B is wrong because a shared services account with cross-account roles centralizes access control, which contradicts the requirement for business units to retain administrative control over their own accounts. Option D is wrong because migrating all workloads to a single account violates the decentralized IT structure and removes business unit autonomy, while IAM roles alone cannot enforce baseline security policies across separate accounts.

Practice this question →

394

MCQeasy

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

A.Create a CloudTrail trail in the management account that applies to all accounts in the organization.

B.Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.

C.Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.

D.Apply an SCP to require CloudTrail to be enabled in all accounts.

AnswerA

Organization trail simplifies management.

Why this answer

AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Exam trap

The trap here is that candidates often think SCPs can enforce positive actions like enabling a service, but SCPs only deny or allow actions and cannot proactively configure resources.

How to eliminate wrong answers

Option B is wrong because AWS CloudFormation StackSets can deploy CloudTrail configurations across accounts, but this approach requires manual setup, ongoing maintenance, and does not automatically apply to new accounts added to the organization. Option C is wrong because enabling CloudTrail in each member account individually is inefficient, does not scale, and does not enforce compliance across all accounts; it also requires manual configuration for each account. Option D is wrong because Service Control Policies (SCPs) can only restrict permissions (e.g., deny disabling CloudTrail) but cannot proactively enable CloudTrail or configure it to deliver logs to a centralized bucket.

Practice this question →

395

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

A.Apply a service control policy (SCP) to the management account.

B.Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

C.Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.

D.Use AWS Config rules with automatic remediation in each account.

AnswerC

SCPs at the OU level enforce policies across all member accounts.

Why this answer

Applying an SCP at the OU level that denies S3 bucket creation/updates without KMS encryption and HTTPS enforcement provides centralized enforcement across all accounts in the OU. This is the most efficient method as it prevents non-compliant actions at the API level. Option A is incorrect because SCPs applied to the management account do not affect member accounts and the management account itself is not restricted by SCPs.

Option B is incorrect because while Lambda functions could remediate, they are reactive and require per-account deployment, making them less efficient than proactive SCP enforcement. Option D is incorrect because AWS Config rules can detect non-compliance but do not automatically enforce; automatic remediation may require additional setup and is also reactive.

Practice this question →

396

MCQeasy

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

A.Enable AWS CloudTrail and set up a metric filter for CreateAccessKey

B.Apply an IAM policy to all users in each account that denies iam:CreateAccessKey

C.Attach an SCP to the root OU that denies iam:CreateAccessKey

D.Use AWS Config to detect access key creation and trigger a Lambda to delete the key

AnswerC

SCPs centrally deny actions across all accounts.

Why this answer

A Service Control Policy (SCP) attached to the root organizational unit denies the iam:CreateAccessKey action across all accounts in the organization, providing centralized enforcement. Option A is wrong because CloudTrail logs events but does not prevent them. Option B is wrong because applying an IAM policy in each account is not centrally managed and may be overridden by administrator permissions.

Option D is wrong because AWS Config detects but cannot prevent the action, and the remediation Lambda may have a delay.

Practice this question →

397

MCQhard

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

A.The SCP does not include 'ec2:RunInstances' in the list of allowed actions.

B.The SCP is attached only to the root OU and not to the specific account OUs.

C.The IAM roles used by the DevOps team do not have a trust policy that allows the EC2 service.

D.The SCP denies all actions except those from allowed services, but the console makes calls that are not from an allowed service.

AnswerD

The console may call other services (e.g., CloudFormation) to launch instances, which could be denied if not in allowed list.

Why this answer

SCPs that deny all actions unless the request comes from allowed services would block the initial API call to EC2 because the console makes calls to multiple services. Option A is wrong because the SCP already allows EC2. Option B is wrong because the SCP is attached to the root OU, so it applies to all accounts.

Option C is wrong because the issue is not about resource-based policies.

Practice this question →

398

MCQeasy

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

A.Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.

B.Configure the bucket ACL to allow write access for all member account root users.

C.Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.

D.Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.

AnswerD

This is the standard method for cross-account CloudTrail log delivery.

Why this answer

CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

Exam trap

The trap here is confusing the 'logs.amazonaws.com' service principal (used for VPC Flow Logs, ELB logs, etc.) with the 'cloudtrail.amazonaws.com' service principal required for CloudTrail cross-account delivery.

How to eliminate wrong answers

Option A is wrong because CloudTrail does not use IAM role assumption for cross-account delivery; it relies on resource-based policies (bucket policies) on the S3 bucket, not on the security account assuming a role. Option B is wrong because S3 bucket ACLs are legacy and do not support cross-account CloudTrail delivery; CloudTrail requires a bucket policy, not ACLs, and root user access is not the mechanism used. Option C is wrong because the service principal 'logs.amazonaws.com' is used for AWS service logs (like ELB or CloudFront), not for CloudTrail; CloudTrail uses the 'cloudtrail.amazonaws.com' service principal.

Practice this question →

399

MCQeasy

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

A.AWS IAM

B.AWS Organizations

C.AWS Control Tower

D.AWS Service Catalog

AnswerB

Organizations allows you to centrally manage multiple accounts.

Why this answer

AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Exam trap

The trap here is that candidates often confuse AWS Control Tower (a managed landing zone service) with AWS Organizations (the underlying account management service), but Control Tower relies on Organizations and is not the service designed for direct central management of multiple accounts.

How to eliminate wrong answers

Option A is wrong because AWS IAM is an identity and access management service for a single account; it cannot create or manage multiple accounts. Option C is wrong because AWS Control Tower is a higher-level service that uses AWS Organizations under the hood to set up a multi-account landing zone, but it is not the core service designed for central management—it is an orchestration layer. Option D is wrong because AWS Service Catalog is used to create and manage a catalog of approved IT services (e.g., EC2, RDS) for end users; it does not manage multiple accounts or their structure.

Practice this question →

400

MCQeasy

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

A.Create a separate AWS account for prod and use an IAM policy on the account.

B.Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.

C.Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.

D.Use AWS Config to detect non-approved instance types and terminate them.

AnswerB

SCPs can be applied to OUs to restrict actions in specific accounts.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking IAM policies can centrally restrict all accounts in an OU, when in fact SCPs are the only AWS Organizations feature that applies a guardrail across all accounts without requiring per-account configuration.

How to eliminate wrong answers

Option A is wrong because creating a separate account for prod does not by itself restrict instance types; you would still need an SCP or IAM policy to enforce the restriction, and IAM policies on a single account cannot centrally manage multiple accounts. Option C is wrong because IAM policies attached to users in prod accounts can be overridden by other IAM policies or bypassed by users with administrative privileges, and they do not apply to the root user or services running without an explicit IAM role. Option D is wrong because AWS Config is a detective control that can detect non-approved instance types after they are launched, but it cannot prevent the launch; it would require a separate remediation action (e.g., Lambda) to terminate instances, which is reactive and not a preventive restriction.

Practice this question →

401

MCQhard

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

A.Use AWS Lambda to scan all VPCs daily and enable Flow Logs if missing, sending logs to the central bucket.

B.Use AWS Config rules with automatic remediation to enable VPC Flow Logs, and a CloudWatch Events rule to copy logs to the central bucket.

C.Use AWS CloudFormation StackSets to deploy a VPC with Flow Logs enabled in each account.

D.Use AWS Config rules with automatic remediation to enable VPC Flow Logs that publish to a central S3 bucket, and use an SCP to prevent disabling Flow Logs.

AnswerD

Config rules can detect VPCs without Flow Logs and remediate by enabling them; SCPs prevent tampering.

Why this answer

AWS Config rules can continuously evaluate whether VPC Flow Logs are enabled for every VPC, and automatic remediation (via an SSM automation document or Lambda) can enable them if they are missing, publishing directly to a central S3 bucket. An SCP (Service Control Policy) then prevents any IAM action that would disable or modify the Flow Log configuration, ensuring enforcement is permanent and cannot be bypassed by account administrators.

Exam trap

The SAP-C02 exam often tests the misconception that a reactive approach (like daily Lambda scans) or a deployment-only approach (like StackSets) is sufficient, when the real requirement is continuous enforcement and prevention of disabling — which demands a combination of AWS Config with remediation and an SCP.

How to eliminate wrong answers

Option A is wrong because a daily Lambda scan is reactive and not continuous; it introduces a window of non-compliance between scans, and it does not prevent disabling of Flow Logs after they are enabled. Option B is wrong because while AWS Config rules with remediation can enable Flow Logs, copying logs via CloudWatch Events to a central bucket is inefficient and adds complexity; VPC Flow Logs can be published directly to a central S3 bucket without needing a separate copy mechanism. Option C is wrong because CloudFormation StackSets can only deploy resources where they are explicitly defined; they cannot enforce Flow Logs on existing VPCs or prevent future VPCs from being created without Flow Logs, nor can they prevent disabling of Flow Logs.

Practice this question →

402

MCQeasy

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

A.Enable AWS CloudTrail and use Amazon Athena to query logs periodically and send a report.

B.Enable AWS CloudTrail in all accounts with a trail that logs management events and delivers to a centralized S3 bucket. Use Amazon CloudWatch Events to create a rule that matches root user API calls and sends notifications via Amazon SNS.

C.Use AWS Config rules to detect root user activities and trigger an AWS Lambda function to send an email.

D.Use AWS Trusted Advisor to check for root user usage and generate a weekly report.

AnswerB

This provides real-time alerting on root activities.

Why this answer

It combines AWS CloudTrail logging of management events across all accounts into a centralized S3 bucket with Amazon CloudWatch Events (now Amazon EventBridge) to detect root user API calls in real time. This setup ensures immediate notification via Amazon SNS, meeting the requirement for instant reporting without manual polling or batch processing.

Exam trap

The trap here is that candidates may confuse AWS Config rules (which monitor resource configurations) with CloudTrail event monitoring, or assume periodic tools like Athena or Trusted Advisor can satisfy an immediate reporting requirement.

How to eliminate wrong answers

Option A is wrong because using Amazon Athena to query logs periodically introduces a delay (not immediate reporting) and requires manual or scheduled queries, which does not meet the real-time requirement. Option C is wrong because AWS Config rules are designed for resource configuration compliance and change detection, not for monitoring API calls like root user activities; they cannot directly capture CloudTrail events or root user login actions. Option D is wrong because AWS Trusted Advisor provides a weekly report on root user usage, which is not immediate and fails the requirement for real-time notification.

Practice this question →

403

MCQeasy

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

A.CloudTrail cannot log management events for member accounts from the management account.

B.The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.

C.The trail is configured to log only read events.

D.The member accounts have disabled CloudTrail.

AnswerB

Cross-account log delivery requires proper bucket policy.

Why this answer

A trail in the management account can log management events for all accounts, but it requires that the trail be created with the option 'Apply trail to all accounts in the organization' and the S3 bucket policy must allow CloudTrail to write from member accounts. Option A is wrong because there is no such limitation. Option C is wrong because CloudTrail supports cross-account delivery.

Option D is wrong because the bucket policy is likely the issue.

Practice this question →

404

MCQhard

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

A.Partition the data by account ID, region, and date in the S3 bucket, and use partitions in Athena.

B.Use S3 object-level compression (e.g., gzip) to reduce data volume.

C.Create AWS Glue partition indexes on the table.

D.Create separate Athena tables for each account and region.

AnswerA

Partition pruning ensures Athena scans only relevant partitions.

Why this answer

Partitioning the S3 data by account ID, region, and date allows Athena to use partition pruning, which limits the amount of data scanned to only the relevant partitions based on query filters. This directly reduces query cost because Athena charges per amount of data scanned, and partitioning is the most effective way to minimize scanned data without additional compression or indexing overhead.

Exam trap

The trap here is that candidates often confuse performance optimization (e.g., compression, indexes) with cost optimization (reducing data scanned), and they may overlook that partition pruning is the primary mechanism to minimize Athena query costs, not just speed up queries.

How to eliminate wrong answers

Option B is wrong because S3 object-level compression (e.g., gzip) reduces storage size and can reduce data scanned if Athena supports reading compressed files, but it does not limit which files are scanned; Athena still must read all compressed objects unless partitions are used. Option C is wrong because AWS Glue partition indexes improve query performance by reducing metadata lookup time, but they do not reduce the amount of data scanned; they only speed up partition discovery, not cost. Option D is wrong because creating separate Athena tables for each account and region increases management overhead and does not inherently reduce data scanned; queries would still scan entire tables unless partitions are used within each table, and this approach duplicates schema management without cost benefit.

Practice this question →

405

MCQmedium

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

A.Create an AWS Config aggregator in the management account and enable Config for each account manually.

B.Use AWS CloudFormation StackSets to deploy a Config template to each account, and manually add new accounts to the StackSet.

C.Use AWS Lambda functions triggered by AWS CloudTrail to enable Config and deploy rules whenever a new account is created.

D.Create an SCP to deny disabling AWS Config, and use an AWS Config conformance pack in a delegated admin account to enforce rules across the organization.

AnswerD

SCP enforces Config enablement; conformance pack enforces rules automatically on new accounts.

Why this answer

It combines an SCP to prevent disabling AWS Config with an AWS Config conformance pack deployed from a delegated admin account, which automatically applies to all existing and new member accounts in the organization. This approach is fully automated, requires no manual intervention for new accounts, and enforces both the enablement of Config and the required rules across the entire organization.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing event-driven or manual approaches (like Lambda or StackSets) instead of recognizing that native AWS Organizations and Config conformance packs provide a fully automated, policy-based enforcement mechanism that requires no per-account management.

How to eliminate wrong answers

Option A is wrong because manually enabling Config for each account is not efficient and does not scale, especially as new accounts are added. Option B is wrong because manually adding new accounts to a CloudFormation StackSet is not automated and requires ongoing administrative overhead, failing the 'most efficient' requirement. Option C is wrong because using a Lambda function triggered by CloudTrail to enable Config and deploy rules is an event-driven workaround that is less reliable and more complex than using native AWS Organizations and Config features; it also does not prevent disabling of Config after initial setup.

Practice this question →

406

MCQmedium

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

A.Amazon CloudWatch Events and Amazon S3 event notifications

B.Amazon CloudWatch Logs and VPC Flow Logs

C.AWS Config and AWS CloudTrail

D.AWS CloudTrail for management events and Amazon S3 server access logs

AnswerD

CloudTrail records S3 API calls for bucket-level actions; S3 server access logs provide object-level access details.

Why this answer

AWS CloudTrail management events log changes to S3 bucket policies and encryption settings (e.g., PutBucketPolicy, PutBucketEncryption), while S3 server access logs provide detailed object-level access records. Together, they satisfy the security policy's requirements for detecting configuration changes and logging access, without needing additional services.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration compliance) with CloudTrail (which logs API calls), failing to realize that Config does not log access events, so it cannot satisfy the 'access must be logged' requirement alone.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Events and S3 event notifications are designed for real-time event-driven workflows (e.g., triggering Lambda on object creation), not for auditing historical changes to bucket policies or encryption settings. Option B is wrong because CloudWatch Logs is a log storage/analysis service, not a source of audit logs, and VPC Flow Logs capture network traffic metadata (IP addresses, ports) but not S3 configuration changes or data access. Option C is wrong because AWS Config tracks resource configuration changes and can evaluate compliance rules, but it does not log access events; CloudTrail is needed for access logging, making this combination incomplete for the 'access must be logged' requirement.

Practice this question →

407

MCQmedium

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

A.The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

B.The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

C.The EC2 instance launch will be denied because the SCP denies actions in regions not listed.

D.The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

AnswerC

The SCP explicitly denies ec2:* in disallowed regions.

Why this answer

SCPs are evaluated using a deny-by-default model where any action not explicitly allowed is implicitly denied. The SCP in question denies all EC2 actions in any region not listed in the allow list (us-east-1 and eu-west-1). Since ap-southeast-1 is not in that list, the EC2 launch is denied regardless of any IAM permissions the developer may have.

Exam trap

The trap here is that candidates often assume SCPs only restrict permissions (like a boundary) and do not deny, or that IAM permissions can override SCPs, but in reality SCPs can explicitly deny actions and always take precedence over IAM allows.

How to eliminate wrong answers

Option A is wrong because SCPs do not require an explicit allow for the denied region to trigger denial; the SCP explicitly denies all regions not listed, so the launch is denied regardless of any allows elsewhere. Option B is wrong because SCPs can deny permissions; they are not limited to only restricting permissions—they explicitly deny actions when conditions are met. Option D is wrong because even if the developer has IAM permissions to launch in ap-southeast-1, the SCP at the root organizational unit overrides those permissions, resulting in a deny.

Practice this question →

408

MCQeasy

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

A.Enable all AWS services in the management account to centrally manage them.

B.Use the management account as the payer account and also host production workloads.

C.Restrict access to the management account and use it only for organization management tasks.

D.Use the management account for development environments to avoid creating additional accounts.

AnswerC

This minimizes the attack surface.

Why this answer

The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.

Exam trap

The trap here is that candidates often confuse the management account's billing role with a permission to host workloads, or they assume that central management requires enabling all services in the management account, when in fact the management account should be kept as a lightweight, resource-free administrative container.

How to eliminate wrong answers

Option A is wrong because enabling all AWS services in the management account for central management is unnecessary and insecure; instead, services should be enabled only in the member accounts where they are needed, and the management account should not host resources. Option B is wrong because while the management account is the payer account, hosting production workloads in it violates the best practice of isolating the management account from workloads, increasing the attack surface and risk of privilege escalation. Option D is wrong because using the management account for development environments defeats the purpose of a multi-account strategy, which is to isolate environments for security and cost tracking; development workloads should be placed in dedicated member accounts.

Practice this question →

409

MCQeasy

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

A.AWS Resource Access Manager (RAM)

B.AWS PrivateLink

C.VPC peering connection

D.AWS Direct Connect

AnswerA

RAM enables sharing of transit gateways across accounts.

Why this answer

AWS Resource Access Manager (RAM) enables you to share a transit gateway owned by a central network account with other AWS accounts in your organization. This eliminates the need to create separate transit gateway attachments or VPC peering connections, simplifying network architecture and reducing operational overhead.

Exam trap

The trap here is that candidates often confuse VPC peering (which is point-to-point and non-transitive) with transit gateway sharing via RAM, which provides transitive routing and centralized management across multiple accounts.

How to eliminate wrong answers

Option B is wrong because AWS PrivateLink is used to expose services privately within a VPC via interface endpoints, not for sharing transit gateways across accounts. Option C is wrong because VPC peering connects individual VPCs directly but does not provide a centralized hub-and-spoke model or support transitive routing between multiple VPCs and accounts. Option D is wrong because AWS Direct Connect establishes dedicated network connections from on-premises to AWS, not for sharing transit gateways between accounts.

Practice this question →

410

MCQeasy

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

A.Use a service control policy to allow access from other accounts

B.Create IAM users in the development account for each developer

C.Share the access keys of an IAM user in the development account

D.Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it

AnswerD

This follows AWS best practices for cross-account access.

Why this answer

It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.

Exam trap

The trap here is that candidates often confuse service control policies (SCPs) with IAM policies, thinking SCPs can grant cross-account access, but SCPs only act as a guardrail and cannot allow access that isn't already explicitly granted by IAM policies.

How to eliminate wrong answers

Option A is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an AWS Organizations hierarchy; they cannot grant access or allow cross-account access—they only deny or allow permissions within the organization. Option B is wrong because creating IAM users in the development account for each developer from other accounts violates the principle of least privilege and requires managing separate credentials, which is insecure and not scalable for cross-account access. Option C is wrong because sharing access keys of an IAM user exposes long-term credentials, which increases the risk of credential leakage and violates AWS security best practices for cross-account access.

Practice this question →

411

MCQeasy

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

A.Use Cost Explorer to filter by linked account, which automatically groups by business unit.

B.Use AWS Budgets to create budgets per account and manually aggregate.

C.Apply tags to resources and enable cost allocation tags in Billing and Cost Management.

D.Create a separate payer account for each business unit.

AnswerC

Correct: Tagging enables filtering by business unit.

Why this answer

Applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Exam trap

The trap here is that candidates may think filtering by linked account in Cost Explorer is sufficient, but they overlook that without tags or a structured account naming convention, linking accounts to business units requires manual effort, which violates the 'without additional overhead' requirement.

How to eliminate wrong answers

Option A is wrong because Cost Explorer can filter by linked account, but it does not automatically group by business unit unless accounts are tagged or organized in a way that maps to business units; filtering by linked account alone requires manual mapping of account IDs to business units, which adds overhead. Option B is wrong because AWS Budgets is a budgeting tool, not a cost reporting and aggregation tool; manually aggregating budgets per account introduces significant overhead and does not provide a scalable, automated solution for generating cost reports filtered by business unit. Option D is wrong because creating a separate payer account for each business unit defeats the purpose of consolidated billing and increases management complexity, as AWS Organizations is designed to consolidate multiple accounts under a single payer for centralized billing and cost management.

Practice this question →

412

MCQmedium

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

A.Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.

B.Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

C.Use AWS Cost Explorer to report on untagged resources.

D.Create an IAM policy that requires tagging for all actions and attach it to all users.

AnswerA

SCPs prevent creation of untagged resources; Config identifies existing untagged resources.

Why this answer

It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Exam trap

The trap here is that candidates may confuse AWS Config's ability to detect non-compliance with the ability to automatically remediate (e.g., apply tags), or assume that Cost Explorer can enforce tagging, when in fact it only reports on existing tags.

How to eliminate wrong answers

Option B is wrong because AWS Config rules can detect untagged resources but cannot automatically tag them; they only evaluate compliance and can trigger remediation actions (e.g., via Systems Manager Automation), but the statement 'automatically tag them' is misleading as Config itself does not apply tags. Option C is wrong because AWS Cost Explorer is a cost visualization and analysis tool that can filter by tags but cannot enforce tagging on new resources or identify untagged resources in a proactive manner; it only reports on costs associated with tagged resources. Option D is wrong because IAM policies that require tagging for all actions would apply to API calls made by users, but they cannot enforce tagging on resources created by services (e.g., Auto Scaling, CloudFormation) that may not pass the tag condition, and such a policy would be overly restrictive, potentially blocking legitimate operations that do not support tagging.

Practice this question →

413

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

A.Apply a service control policy (SCP) at the root OU that denies s3:PutBucketAcl or s3:PutBucketPolicy actions unless encryption is configured.

B.Use AWS Trusted Advisor to check for unencrypted buckets and notify the security team.

C.Use AWS Config rules in each account to detect non-compliant buckets and trigger auto-remediation.

D.Create a CloudFormation StackSet that deploys an S3 bucket policy in every account.

AnswerC

Correct. AWS Config rules can be deployed across all accounts using StackSets, detect non-compliant buckets, and trigger auto-remediation to apply encryption, providing scalable and maintainable enforcement.

Why this answer

Using AWS Config rules deployed via StackSets across all accounts in the organization provides a scalable and maintainable way to detect non-compliant buckets (e.g., those without SSE-KMS encryption) and trigger auto-remediation to enforce encryption. This approach is proactive and centralized, while still being scalable via AWS Organizations. Option A is incorrect because the SCP actions mentioned (s3:PutBucketAcl and s3:PutBucketPolicy) do not control encryption settings.

Option B is only detective and does not enforce compliance. Option D does not address encryption enforcement.

Exam trap

The trap is that candidates may think an SCP is the only scalable solution, but in this case the SCP described uses the wrong actions. Option C with AWS Config and auto-remediation is a valid and scalable enforcement mechanism.

How to eliminate wrong answers

Option B is wrong because Trusted Advisor only provides reactive checks and notifications; it does not enforce encryption or prevent non-compliant buckets from being created. Option C is wrong because AWS Config rules must be deployed in each account individually (or via delegation), and auto-remediation can be complex to maintain across many accounts; it is less scalable and centralized than an SCP. Option D is wrong because a CloudFormation StackSet deploys a bucket policy in each account, but bucket policies cannot enforce encryption on the bucket itself (they control access), and they can be overridden by the account owner; this does not prevent creation of unencrypted buckets.

Practice this question →

414

Multi-Selectmedium

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Select 2 answers

A.Enable AWS CloudTrail Insights to detect unusual activity.

B.Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.

C.Use IAM roles with a permissions boundary that restricts CloudTrail actions.

D.Add an S3 bucket policy on the CloudTrail log bucket that denies s3:DeleteObject for all principals in the 'Production' OU.

AnswersB, D

SCP prevents the actions at the account level.

Why this answer

Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Exam trap

The trap here is that candidates often think IAM permissions boundaries or CloudTrail Insights can enforce preventive controls, but only SCPs and resource-based policies (like S3 bucket policies) can deny actions across all users and roles in an account at the organizational level.

Practice this question →

415

MCQmedium

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

A.Use Amazon QuickSight to connect to each account's AWS Cost and Usage Report and AWS Config data.

B.Use AWS Control Tower to set up a landing zone and use the built-in dashboard for operational data.

C.Use AWS Config aggregator to collect resource configurations from all accounts.

D.Use AWS Organizations to create a central management account and use AWS Systems Manager Explorer to aggregate operational data.

AnswerD

Systems Manager Explorer provides a single dashboard for operational data.

Why this answer

AWS Systems Manager Explorer, when used with AWS Organizations, provides a single-pane-of-glass dashboard that aggregates operational data (e.g., cost reports, security findings, resource inventory) across multiple accounts. The central management account in Organizations enables Explorer to collect and display data from all member accounts without requiring individual connections or manual aggregation.

Exam trap

The trap here is that candidates often confuse AWS Config aggregator (which only handles resource configurations) with a full operational data aggregator, or assume QuickSight can natively aggregate multi-account operational data without custom integration, leading them to overlook Systems Manager Explorer's purpose-built multi-account dashboard capabilities.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a business intelligence service for visualizing data, not a native aggregator for operational data; connecting to each account's Cost and Usage Report and Config data would require complex, custom pipelines and does not provide a built-in single pane of glass for operations. Option B is wrong because AWS Control Tower's built-in dashboard focuses on governance and compliance (e.g., guardrails, account factory status), not on aggregating operational data like cost reports, security findings, and resource inventory across accounts. Option C is wrong because AWS Config aggregator only collects resource configurations and compliance history, not cost reports or security findings, so it fails to meet the requirement for a comprehensive operational data view.

Practice this question →

416

MCQeasy

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

A.AWS Config rules with auto-remediation

B.AWS Service Catalog with a portfolio of approved AMIs

C.AWS Identity and Access Management (IAM) policies in each account

D.AWS Organizations Service Control Policies (SCPs)

AnswerD

Correct: SCPs can centrally restrict actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that IAM policies in each account can centrally enforce controls, but SCPs are the only mechanism that applies across all accounts in an organization without requiring per-account management.

How to eliminate wrong answers

Option A is wrong because AWS Config rules with auto-remediation are detective and reactive—they can detect non-compliant resources and trigger remediation actions, but they cannot proactively prevent developers from launching EC2 instances in unapproved Regions or with unapproved AMIs at the time of the API call. Option B is wrong because AWS Service Catalog allows you to create a portfolio of approved AMIs that developers can launch, but it does not enforce controls across all accounts; developers could still bypass Service Catalog and launch EC2 directly via the console or CLI if not restricted by other policies. Option C is wrong because IAM policies in each account would require manual duplication and management across every account, leading to inconsistency and administrative overhead, and they cannot be enforced from a central point like SCPs can.

Practice this question →

417

MCQhard

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

A.The member account must create an IAM role to assume for launching resources in the shared subnet.

B.The member account must create a VPC and then associate the shared subnet.

C.The member account must accept the resource share invitation.

D.Nothing, shared subnets are automatically available to all accounts in the organization.

AnswerD

Within an organization, resource shares are automatically accepted.

Why this answer

When AWS Organizations is configured with all features enabled and sharing is enabled within the organization, Resource Access Manager (RAM) automatically shares resources with all accounts in the organization without requiring individual acceptance. Therefore, shared subnets are immediately available to member accounts for launching resources, and no additional action is needed in the member accounts.

Exam trap

The trap here is that candidates often assume a manual acceptance step is always required for RAM shares, but within an organization with enabled sharing, the process is automatic and no invitation or acceptance is needed.

How to eliminate wrong answers

Option A is wrong because member accounts do not need to create an IAM role to assume; they can directly launch resources into the shared subnet using their existing IAM permissions, provided they have the necessary ec2:RunInstances and subnet-related permissions. Option B is wrong because the shared subnet is already part of a centrally managed VPC; member accounts do not need to create their own VPC or associate the subnet—they simply use the shared subnet ID when launching resources. Option C is wrong because when sharing is enabled within an AWS Organization, resource shares are automatically available to all member accounts without requiring an invitation or acceptance; the acceptance step is only needed for accounts outside the organization.

Practice this question →

418

MCQhard

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

A.Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

B.Apply an SCP that allows EC2 actions only in the allowed Regions.

C.Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

D.Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

AnswerB

SCPs deny actions by default, so you must explicitly allow only the desired Regions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking a deny SCP (Option D) is equivalent to an allow SCP, but AWS evaluates SCPs as allow lists by default, making an explicit allow for specific Regions the correct and simpler approach to enforce Region restrictions without unintended side effects.

How to eliminate wrong answers

Option A is wrong because IAM permissions boundaries restrict the maximum permissions a role can have, but they are applied per role and do not prevent developers from creating new roles without the boundary, nor do they enforce Region restrictions across all accounts centrally. Option C is wrong because AWS Config rules are detective, not preventive; they can trigger remediation (e.g., termination) but cannot block the initial launch, leaving a window of unauthorized usage and potential cost. Option D is wrong because a deny SCP for disallowed Regions is less precise than an allow list; it could inadvertently block EC2 actions in allowed Regions if the SCP logic is not carefully crafted, and it does not align with the principle of explicit allow for restricted services.

Practice this question →

419

Multi-Selecthard

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Select 3 answers

A.Use IAM groups to restrict access to CloudTrail and S3.

B.Enable multi-factor authentication (MFA) delete on the S3 bucket.

C.Configure S3 bucket versioning and enable S3 Object Lock.

D.Attach a service control policy (SCP) to the account that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.

E.Store CloudTrail logs in a separate account that only the security team can access.

AnswersB, C, D

MFA delete adds an extra layer of protection to prevent accidental or malicious deletion.

Why this answer

Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.

Exam trap

The trap here is that candidates often overlook the need for multiple complementary controls (MFA delete, S3 Object Lock, and SCPs) and instead choose a single measure like IAM groups or cross-account storage, which do not fully address the requirement to prevent disabling or deletion of CloudTrail and its S3 bucket.

Practice this question →

420

Multi-Selecthard

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Select 2 answers

A.VPC Flow Logs

B.AWS CloudTrail

C.AWS Config

D.Amazon CloudWatch Logs

E.Amazon S3

AnswersB, D

CloudTrail records API calls.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made within an AWS account, including the identity, source IP, and timestamp. Centralizing logging across multiple accounts requires sending these CloudTrail logs to a central Amazon S3 bucket (often with cross-account permissions) and then using Amazon CloudWatch Logs to monitor, alert, or analyze the logs in real time. Together, CloudTrail captures the API activity, and CloudWatch Logs provides a unified log management and monitoring layer.

Exam trap

The trap here is that candidates often pick VPC Flow Logs (Option A) thinking it captures all API traffic, but it only captures network-level flows, not the application-layer API calls that CloudTrail records.

Practice this question →

421

MCQeasy

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

A.Use AWS Config rules to automatically delete non-compliant VPCs.

B.Use IAM policies with conditions on the ec2:CreateVpc action in each account.

C.Use AWS CloudTrail to monitor VPC creation and alert the security team.

D.Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.

AnswerD

SCPs can deny VPC creation if the CIDR does not match allowed ranges.

Why this answer

SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-specific and can be overridden by local admins) with SCPs (which are organization-wide guardrails that cannot be bypassed by member account administrators), leading them to choose Option B instead of the correct preventive control.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect non-compliant VPCs and trigger remediation (e.g., deletion), but they are reactive and cannot prevent the creation of a non-compliant VPC in the first place; the VPC would exist momentarily, potentially causing transient security or networking issues. Option B is wrong because IAM policies with conditions on `ec2:CreateVpc` would need to be applied individually to each member account's IAM roles/users, which is operationally complex and does not prevent a rogue admin with full IAM permissions in that account from bypassing the restriction. Option C is wrong because AWS CloudTrail only logs API calls after they occur; it cannot enforce or block the creation of a VPC, only alert after the fact, which is not a preventive control.

Practice this question →

422

MCQhard

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

A.Establish VPC peering between the workload VPCs and the networking account VPC.

B.Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

C.Create a Route 53 Resolver inbound endpoint in the networking account.

D.Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.

AnswerD

Resolver rules determine how DNS queries are forwarded.

Why this answer

The outbound endpoint forwards DNS queries from the workload VPCs to on-premises resolvers, but it does not automatically configure the workload VPCs to use it. A Route 53 Resolver rule must be created in each workload account (or centrally via RAM) to forward queries for the on-premises domain to the outbound endpoint. Without this rule, the workload VPCs will not send queries for on-premises hostnames to the outbound endpoint, so resolution fails.

Exam trap

The trap here is that candidates assume associating the outbound endpoint with workload VPCs via RAM automatically forwards all DNS queries, but they forget that a forwarding rule is required to specify which domain names should be sent to the outbound endpoint.

How to eliminate wrong answers

Option A is wrong because VPC peering does not enable DNS resolution forwarding; it only provides network connectivity, and the Transit Gateway already connects the VPCs. Option B is wrong because a private hosted zone is used to resolve custom domain names within AWS, not to forward queries to on-premises resolvers. Option C is wrong because an inbound endpoint allows on-premises resolvers to query Route 53 Resolver in AWS, but the issue is workload VPCs resolving on-premises hostnames, which requires an outbound endpoint with a forwarding rule.

Practice this question →

423

Multi-Selecthard

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Select 3 answers

A.Create an IAM policy in each account that requires tags on role creation

B.Set up AWS Budgets to alert on untagged roles

C.Attach the SCP to the root organizational unit to apply it to all accounts

D.Create a service control policy (SCP) that denies iam:CreateRole if the request does not include the required tag

E.Use AWS Config rules to detect roles missing the tag and trigger automatic remediation

AnswersC, D, E

Attaching to root ensures all accounts are covered.

Why this answer

AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.

Exam trap

The trap here is that candidates often confuse AWS Budgets (a cost alerting tool) with a governance enforcement mechanism, or think that per-account IAM policies are sufficient for centralized control, missing the fact that SCPs are the only way to enforce organization-wide guardrails that cannot be overridden by account administrators.

Practice this question →

424

MCQhard

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

A.Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

B.Use an SCP to deny the iam:UpdateAccountPasswordPolicy action and deploy a password policy using CloudFormation StackSets.

C.Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

D.Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

AnswerB

Correct: Prevents changes and enforces policy.

Why this answer

An SCP can deny the iam:UpdateAccountPasswordPolicy action, preventing member accounts from altering the password policy, while CloudFormation StackSets can deploy a compliant password policy across all member accounts automatically. This combination provides a preventive control that enforces the minimum 14-character requirement without relying on user action or reactive detection.

Exam trap

The trap here is that candidates often choose a detective/reactive solution (like AWS Config with auto-remediation) because it seems automated, but the question explicitly asks for a preventive control that is enforced automatically, which requires blocking the ability to change the policy (SCP) and proactively applying the correct policy (StackSets).

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog requires account owners to manually launch the product, which is not automatic and does not prevent non-compliance if they skip it. Option C is wrong because SCPs cannot conditionally deny iam:CreateUser based on password policy requirements; password policy is an account-level setting, not a per-user request parameter, and the iam:CreateUser action does not support such a condition key. Option D is wrong because AWS Config rules are detective and reactive, not preventive; they detect non-compliance after the fact and auto-remediation via Lambda is still a corrective action, not an automatic preventive enforcement.

Practice this question →

425

MCQhard

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

A.The SCP syntax is invalid because it uses StringNotEquals

B.The SCP must also allow the allowed instance types in a separate statement

C.The SCP does not include an Allow statement for the allowed instance types

D.The SCP is not attached to the correct OU or root

AnswerD

If the SCP is not attached to the OU containing the accounts, it will not take effect.

Why this answer

The most likely reason is that the SCP is not attached to the correct OU or root. SCPs must be explicitly attached to the target OU, account, or root to take effect. If the SCP is attached to a different OU or not attached at all, it will not restrict the accounts in the intended OU, allowing users to launch any instance type.

Exam trap

The trap here is that candidates assume SCPs apply globally once created, but they must be explicitly attached to the target OU, account, or root to take effect.

How to eliminate wrong answers

Option A is wrong because StringNotEquals is a valid condition key operator in SCPs; the syntax is not invalid. Option B is wrong because SCPs do not require separate Allow statements for allowed types; a single Deny with a NotResource or NotCondition can effectively restrict to allowed types. Option C is wrong because SCPs are deny-by-default; they do not need an explicit Allow statement for allowed instance types—the default implicit Allow covers them unless explicitly Denied.

Practice this question →

426

MCQmedium

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

A.Use AWS Service Catalog portfolio to share templates.

B.Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

C.Use AWS CloudFormation StackSets and manually trigger them for new accounts.

D.Use AWS Control Tower Account Factory Customization (AFC).

AnswerD

AFC automatically deploys custom templates to new accounts.

Why this answer

AWS Control Tower Account Factory Customization (AFC) is designed to automatically apply custom CloudFormation templates to new accounts provisioned through Account Factory within a specified OU. It uses lifecycle events to trigger the deployment, ensuring that every new account in the OU receives the baseline configuration without manual intervention.

Exam trap

The trap here is that candidates may confuse AWS Control Tower Account Factory Customization with AWS CloudFormation StackSets, but StackSets lack the automatic triggering mechanism tied to new account creation in an OU, which AFC provides natively.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog portfolios share templates for self-service provisioning but do not automatically deploy them when a new account is added to an OU. Option B is wrong because AWS CloudFormation does not have lifecycle hooks; lifecycle hooks are a feature of Auto Scaling groups and AWS CodeDeploy, not CloudFormation. Option C is wrong because while CloudFormation StackSets can deploy templates across accounts, they require manual triggering or custom automation to run when a new account joins an OU, which defeats the 'whenever a new account is added' requirement.

Practice this question →

427

MCQhard

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

A.Increase the SQS visibility timeout to 30 minutes.

B.Use DynamoDB on-demand capacity mode.

C.Configure an SQS dead-letter queue for failed messages.

D.Set Lambda reserved concurrency to a low value to control costs.

AnswerC

DLQ captures messages that cannot be processed, ensuring no data loss.

Why this answer

An SQS dead-letter queue (DLQ) captures messages that cannot be processed successfully after the maximum retries are exhausted, preventing event loss during traffic spikes. This ensures that failed messages are preserved for later analysis or reprocessing, which is critical for reliability in a serverless event-driven architecture.

Exam trap

The trap here is that candidates may confuse scalability features (like DynamoDB on-demand or Lambda concurrency) with reliability mechanisms for message processing, overlooking that a dead-letter queue is the specific AWS-recommended pattern to prevent event loss in SQS-based architectures.

How to eliminate wrong answers

Option A is wrong because increasing the SQS visibility timeout to 30 minutes does not prevent event loss; it only delays the reappearance of unprocessed messages in the queue, and if the Lambda function fails, the message will eventually become visible again and may still be lost if not handled. Option B is wrong because DynamoDB on-demand capacity mode handles traffic spikes without throttling, but it does not address event loss from Lambda processing failures or SQS message handling; it only ensures database scalability. Option D is wrong because setting Lambda reserved concurrency to a low value to control costs can cause throttling during traffic spikes, leading to SQS messages being discarded or sent to a DLQ only if configured, but it actively reduces reliability by limiting concurrent executions.

Practice this question →

428

MCQhard

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

A.Remove the SCP from the root.

B.Modify the bucket policy to allow s3:PutObject without tags.

C.Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.

D.Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

AnswerC

This allows the logging services to write logs while still requiring tags for other PutObject calls.

Why this answer

The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag.

Option C allows the services to bypass the tag requirement.

Practice this question →

429

MCQhard

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

A.Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.

B.Use an SCP that denies all IAM actions except those from a specific admin account.

C.Use an IAM password policy that requires multi-factor authentication for all users.

D.Create an IAM role in each account with full administrator access and use a break-glass process to assume it.

AnswerA

IAM Identity Center allows time-limited, auditable access elevation.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Exam trap

The trap here is that candidates often confuse a static IAM role with a break-glass process (Option D) as sufficient for least privilege, but they overlook that without temporary credentials and approval workflows, the role grants persistent full admin access to anyone who can assume it, violating the least-privilege principle.

How to eliminate wrong answers

Option B is wrong because an SCP that denies all IAM actions except from a specific admin account would block the operations team from assuming any role or performing IAM operations, including the emergency access they need, and does not provide a temporary elevation mechanism. Option C is wrong because an IAM password policy requiring MFA only controls password-based authentication for IAM users; it does not prevent a user from having full administrator access or provide a way to grant temporary elevated permissions. Option D is wrong because creating an IAM role with full administrator access in each account and using a break-glass process to assume it does not enforce least privilege—it grants permanent full admin access to anyone who can assume the role, and the 'break-glass' process is not inherently controlled or audited without additional mechanisms like approval workflows.

Practice this question →

430

Multi-Selectmedium

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Select 2 answers

A.AWS Key Management Service (KMS)

B.AWS Organizations Service Control Policies (SCPs)

C.AWS Config

D.AWS Identity and Access Management (IAM) Access Analyzer

E.AWS CloudTrail

AnswersB, D

SCPs can restrict permissions at the account level, enforcing least privilege.

Why this answer

AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Exam trap

The trap here is that candidates often confuse AWS Config (which detects compliance) with a service that enforces policies, or they think KMS or CloudTrail can restrict permissions, when in fact only SCPs and IAM Access Analyzer (for validating policies against least-privilege) directly support enforcing or validating a least-privilege model across multiple accounts.

Practice this question →

431

MCQmedium

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

A.Use SSE-S3 encryption. Grant cross-account access via bucket policy.

B.Use SSE-C encryption. Provide the same customer key to all accounts.

C.Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.

D.Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

AnswerC

Allows centralized key management and cross-account access via key policy.

Why this answer

A multi-region key is not needed, and cross-account access requires key policy. Option A is wrong because SSE-S3 does not allow cross-account access control. Option B is wrong because SSE-C requires managing keys externally.

Option D is wrong because S3 bucket policies cannot grant access to KMS keys.

Practice this question →

432

Multi-Selecthard

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Select 3 answers

A.Amazon CloudWatch Logs subscription filter in each account.

B.AWS CloudTrail in the central account only.

C.A central S3 bucket in the logging account.

D.A bucket policy on the central bucket that grants write access to the source accounts.

E.IAM roles in each source account with permissions to write to the central bucket.

AnswersC, D, E

Destination for logs.

Why this answer

A central S3 bucket in a dedicated logging account is the foundational component for aggregating logs from multiple AWS accounts. This bucket serves as the single destination for all log data, enabling centralized storage, analysis, and retention without exposing logs to individual source accounts.

Exam trap

The trap here is that candidates often assume CloudWatch Logs subscription filters are mandatory for S3-based logging, but they are actually used for real-time streaming to other services, not for writing logs directly to S3 from multiple accounts.

Practice this question →