CCNA Org Complexity Questions — Page 2 of 6

MCQhard

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

A.Create a VPN connection from each VPC to a central network appliance.

B.Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

C.Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.

D.Create VPC peering connections between each VPC and a central VPC.

AnswerC

Allows centralized management and self-service attachment via RAM.

Why this answer

AWS Transit Gateway allows you to centralize network connectivity across multiple VPCs and accounts. By creating the Transit Gateway in the networking account and sharing it via AWS Resource Access Manager (RAM), you enable individual account owners to attach their VPCs to the shared Transit Gateway, achieving private communication while maintaining centralized management.

Exam trap

The trap here is that candidates often confuse AWS PrivateLink (which is for service exposure, not general routing) with Transit Gateway, or assume VPC peering can be scaled via a central VPC, failing to recognize that peering is non-transitive and requires a full mesh for multi-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because VPN connections from each VPC to a central network appliance introduce significant complexity, bandwidth limitations, and operational overhead; they do not leverage native AWS transit capabilities and are not designed for scalable inter-VPC communication across hundreds of accounts. Option B is wrong because AWS PrivateLink is used to expose services privately from a VPC to other VPCs, not to enable general VPC-to-VPC routing; it requires creating endpoint services and does not provide a hub-and-spoke transit architecture for arbitrary VPC connectivity. Option D is wrong because VPC peering connections are one-to-one and do not scale to hundreds of accounts; they require full mesh or star topology with manual peering for each pair, and they do not support transitive routing, making centralized management impractical.

Practice this question →

MCQeasy

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

A.Create an Organizational Unit for each business unit within the existing account.

B.Use IAM policies with conditions based on resource tags to restrict access within the single account.

C.Create a separate AWS account for each business unit and use consolidated billing to manage costs.

D.Use Service Control Policies to restrict each business unit's access to specific services.

AnswerB

Allows logical separation without additional accounts.

Why this answer

It allows business units to have their own IAM users and permissions within the single account by using IAM policies with conditions based on resource tags, minimizing administrative overhead and avoiding additional costs associated with multiple accounts. Option A is incorrect because creating an OU within the existing account does not provide separate IAM user management; OUs are for grouping accounts in Organizations, not for user management. Option C is incorrect because while separate accounts with consolidated billing can provide separation, it increases administrative overhead and may lead to higher costs due to minimum usage per account.

Option D is incorrect because SCPs are used to manage permissions at the account level, not for individual IAM users; they cannot provide the granular user-level control that the business units require.

Practice this question →

MCQhard

A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?

A.Use Amazon EventBridge to capture API calls from all accounts and route them to a central CloudWatch Logs group.

B.Enable CloudTrail in each account and configure the trail to send logs to a CloudWatch Logs group in that account. Then create a cross-account CloudWatch dashboard.

C.Use CloudWatch cross-account observability to aggregate logs from all accounts into a single monitoring account.

D.Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.

AnswerD

Organization trail centralizes logs, and CloudWatch Logs can create metrics and dashboards.

Why this answer

Enabling an organization trail in CloudTrail from the management account automatically applies to all accounts in the AWS Organization, delivering logs to a central S3 bucket with minimal per-account configuration. Using CloudWatch Logs with metric filters on that S3 bucket allows the security team to create a central CloudWatch dashboard that monitors API activity across all accounts, satisfying the requirement with the least operational overhead.

Exam trap

The trap here is that candidates often assume cross-account observability (Option C) is the simplest solution for central monitoring, but it does not natively aggregate CloudTrail logs and requires additional configuration, whereas an organization trail provides automatic, centralized logging with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge captures events from AWS services but does not natively capture all API calls; CloudTrail is the service designed to log API activity, and EventBridge would require custom rules and additional infrastructure to route logs centrally. Option B is wrong because enabling CloudTrail in each account individually and sending logs to separate CloudWatch Logs groups creates significant operational overhead (managing trails per account) and cross-account dashboards require complex IAM permissions and log group sharing, which is not the simplest approach. Option C is wrong because CloudWatch cross-account observability is designed for monitoring metrics, logs, and traces across accounts but does not directly aggregate CloudTrail logs; it would still require each account to send logs to a central monitoring account, adding overhead compared to a single organization trail.

Practice this question →

MCQhard

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

A.The production account's IAM policy denies s3:DeleteBucket.

B.The SCP only applies to the management account.

C.The SCP applies to the production account because it is attached to the root.

D.The production account is the management account.

AnswerC

SCPs at the root apply to all member accounts.

Why this answer

SCPs are applied to all accounts in the organization when attached to the root, including the production account. The SCP denying s3:DeleteBucket is an effective deny that overrides any allow in IAM policies, so the production account's administrator cannot delete the bucket regardless of their IAM permissions.

Exam trap

The trap here is that candidates often think SCPs only affect the management account or that IAM policies can override SCPs, but SCPs attached to the root apply to all member accounts and create an effective deny that IAM policies cannot bypass.

How to eliminate wrong answers

Option A is wrong because even if the production account's IAM policy allows s3:DeleteBucket, the SCP deny at the root overrides it (an explicit deny in an SCP is an effective deny). Option B is wrong because SCPs attached to the root apply to all member accounts in the organization, not just the management account. Option D is wrong because the production account (222222222222) is a separate member account, not the management account (111111111111).

Practice this question →

MCQhard

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

A.Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

B.Create VPC peering connections between all VPCs and use route tables to control access.

C.Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.

D.Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

AnswerC

Separate route tables allow granular routing, and network ACLs can filter traffic at the subnet level.

Why this answer

It uses a central transit gateway with separate route tables for each VPC attachment, which allows the networking team to enable communication between all VPCs via the transit gateway while the security team can isolate specific accounts by controlling which route tables are associated with which VPC attachments. Network ACLs in each VPC provide an additional layer of stateless traffic filtering to restrict traffic between specific VPCs, complementing the route table isolation.

Exam trap

The trap here is that candidates assume a single transit gateway route table with security groups or network ACLs is sufficient, but security groups cannot filter traffic at the VPC level and network ACLs alone do not prevent the transit gateway from routing traffic between VPCs—route table isolation is the primary mechanism to enforce such restrictions.

How to eliminate wrong answers

Option A is wrong because a single route table in a transit gateway would allow all attached VPCs to communicate with each other by default, and VPC endpoints are used for private access to AWS services (e.g., S3, DynamoDB), not for controlling traffic between VPCs. Option B is wrong because VPC peering connections require a full mesh of connections (O(n²) complexity) and do not scale for a global company with many accounts; route tables alone cannot enforce the security requirement to block specific account pairs without complex, manual configuration. Option D is wrong because a single route table in the transit gateway would allow all VPCs to communicate, and security groups are stateful firewalls that operate at the instance level (not the VPC level) and cannot restrict traffic between entire VPCs or prevent VPC-to-VPC routing through the transit gateway.

Practice this question →

MCQeasy

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

A.AWS CloudFormation Drift Detection

B.AWS CloudFormation StackSets

C.AWS CloudFormation Change Sets

D.AWS CloudFormation Nested Stacks

AnswerC

Change Sets provide a preview of changes before execution.

Why this answer

AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the DevOps team to review and approve stack updates by generating a summary of the changes (additions, modifications, deletions) without executing them immediately, meeting the requirement for a review-and-approval workflow.

Exam trap

The trap here is that candidates may confuse Drift Detection (which detects post-deployment configuration drift) with Change Sets (which preview intended changes before deployment), leading them to select Option A incorrectly.

How to eliminate wrong answers

Option A is wrong because Drift Detection is used to detect whether a stack's actual resources have deviated from the expected template configuration, not to review or approve updates before execution. Option B is wrong because StackSets enable you to deploy stacks across multiple accounts and regions from a single template, but they do not provide a mechanism to preview or approve changes before applying them. Option D is wrong because Nested Stacks allow you to compose stacks from other stacks for modularity, but they do not offer a change review or approval process for updates.

Practice this question →

Multi-Selecteasy

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Select 2 answers

A.Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

B.Enable AWS Config in all accounts to track patch compliance.

C.Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

D.Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.

E.Create a maintenance window in the management account and target instances using AWS Resource Groups that span accounts.

AnswersD, E

Required for SSM to manage instances.

Why this answer

Systems Manager requires an IAM service role in each member account to delegate permissions from the management account; the AmazonSSMManagedInstanceCore policy provides the minimum necessary permissions for SSM Agent to communicate with the Systems Manager service. Option E is correct because a maintenance window created in the management account can target instances across multiple accounts using AWS Resource Groups that are configured with cross-account resource queries, enabling centralized patch management without logging into each account.

Exam trap

The trap here is that candidates often confuse instance-level permissions (instance profile) with account-level permissions (service role), and they overlook that a maintenance window in the management account can target instances in member accounts only when a proper IAM service role is configured in each member account to allow cross-account Systems Manager operations.

Practice this question →

MCQhard

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

A.Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

B.Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

C.Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

D.Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.

AnswerD

This enforces data residency at the organizational level.

Why this answer

AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies or permissions boundaries, thinking that IAM-level controls are sufficient for cross-account isolation, when in fact only SCPs at the OU level can enforce a hard deny across all accounts in an organization.

How to eliminate wrong answers

Option A is wrong because creating OUs per account type (Prod, Dev, Test) does not provide a mechanism to isolate access between countries; tags can be changed or omitted, and SCPs based on tags are not a reliable enforcement for strict data residency requirements. Option B is wrong because a single OU for all accounts cannot enforce cross-country isolation; IAM permissions boundaries are per-account and do not prevent cross-account access between countries within the same OU. Option C is wrong because AWS Resource Access Manager (RAM) is used for sharing resources, not for restricting access; IAM policies alone cannot prevent cross-country access if the accounts are in the same organization without SCPs at the OU level.

Practice this question →

MCQmedium

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

A.Set up a VPN connection from each VPC to the on-premises AD.

B.Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.

C.Clone the directory and deploy it in each account.

D.Deploy an AD Connector in each VPC pointing to the on-premises AD.

AnswerB

Allows centralized directory with cross-account sharing.

Why this answer

AWS Resource Access Manager (RAM) allows you to share AWS Managed Microsoft AD directories across accounts without duplicating the directory or managing multiple trust relationships. This provides a single, centrally managed directory that multiple VPCs in different accounts can authenticate against, ensuring scalability and security by avoiding cross-account credential replication or complex VPN meshes.

Exam trap

The trap here is that candidates often assume each VPC needs its own directory or AD Connector, but AWS RAM enables secure, scalable sharing of a single Managed AD across accounts without additional infrastructure.

How to eliminate wrong answers

Option A is wrong because setting up a VPN from each VPC to on-premises AD does not leverage AWS Managed Microsoft AD and introduces latency, single points of failure, and management overhead for multiple VPN tunnels; it also fails to migrate the directory to AWS as required. Option C is wrong because cloning the directory and deploying it in each account creates multiple independent directories that require complex cross-forest trusts or replication, breaking the requirement for a single shared directory and increasing administrative burden. Option D is wrong because deploying an AD Connector in each VPC points back to the on-premises AD, which does not migrate the directory to AWS Managed Microsoft AD and still relies on on-premises infrastructure, defeating the purpose of the migration.

Practice this question →

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

A.Use AWS CloudTrail to monitor and alert on bucket creation without encryption

B.Use AWS Config rules with auto-remediation in each account

C.Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption

D.Define an IAM policy in each account to deny S3:PutBucket without encryption

AnswerC

SCPs centrally deny actions across all accounts.

Why this answer

A service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Exam trap

The trap here is that candidates often choose AWS Config with auto-remediation (Option B) because it can fix noncompliant buckets, but they overlook that SCPs provide a preventive, centrally managed control that cannot be overridden by account-level administrators, which is the key requirement for central enforcement across multiple accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is a logging service that records API calls; it can alert on bucket creation without encryption but cannot enforce or prevent the creation of unencrypted buckets—it is reactive, not proactive. Option B is wrong because AWS Config rules with auto-remediation run within each individual account and require per-account setup; they do not provide a central enforcement mechanism across all accounts in an organization, and auto-remediation can be disabled or bypassed by account administrators. Option D is wrong because IAM policies defined in each account can be modified or removed by administrators in that account, so they do not provide a centrally enforceable, immutable guardrail across the entire organization.

Practice this question →

MCQmedium

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

A.Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

B.Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.

C.Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

D.Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

AnswerB

RAM provides fine-grained sharing and the service-linked role ensures secure creation of resources.

Why this answer

AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Exam trap

The trap here is that candidates often confuse network connectivity solutions (like Transit Gateway or VPC Peering) with resource sharing and authorization mechanisms, leading them to select options that enable traffic flow but do not control which accounts can create resources in shared subnets.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub for routing traffic between VPCs and on-premises networks, not a mechanism to control which accounts can create resources in shared subnets; route tables manage traffic flow, not authorization. Option C is wrong because VPC Peering connections enable network connectivity between VPCs but do not provide a way to share subnets or control which accounts can launch EC2 instances in them; security groups only filter traffic at the instance level, not authorize account-level access. Option D is wrong because an SCP that denies ec2:RunInstances unless the subnet is in the network account would prevent all consuming accounts from launching instances in shared subnets, as the subnet belongs to the network account, not the consuming account; SCPs cannot conditionally allow actions based on subnet ownership across accounts in this way.

Practice this question →

Multi-Selecteasy

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Select 1 answer

A.AWS Cloud Directory

B.A service control policy (SCP) attached to the root

C.An IAM user in each account

D.An external identity provider (IdP) such as Azure AD or Okta

E.Permission sets that define the level of access to each account

AnswersE

Permission sets are always required to define access levels for users and groups.

Why this answer

AWS Single Sign-On requires an identity source and permission sets. The identity source can be the built-in identity store or an external identity provider (IdP). Therefore, an external IdP is not strictly required.

From the given options, only permission sets (E) are a required component.

Exam trap

Candidates often mistakenly think an external IdP is mandatory for AWS SSO, but AWS SSO includes a built-in identity store that can manage access to AWS accounts. An external IdP is optional and primarily needed for business applications.

Practice this question →

Multi-Selecthard

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Select 3 answers

A.Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.

B.Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

C.Enable AWS CloudTrail Insights in each account to capture S3 access logs.

D.Create an AWS CloudTrail trail in each account that delivers logs to the central S3 bucket.

E.Apply a bucket policy on the central S3 bucket that grants cross-account write access from each account's CloudTrail service.

AnswersA, D, E

S3 server access logs are enabled per bucket and can be delivered to a target bucket.

Why this answer

S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Exam trap

The trap here is that candidates often confuse CloudWatch Logs subscription filters or CloudTrail Insights as mechanisms to collect S3 access logs, when in fact S3 server access logging and CloudTrail trails are the correct services for this centralized logging requirement.

Practice this question →

Multi-Selectmedium

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Select 2 answers

A.Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.

B.Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.

C.Configure AWS IAM Identity Center to restrict access to approved Regions.

D.Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.

E.Create a service control policy (SCP) that denies all actions in non-compliant Regions. Attach it to the root or OUs.

AnswersA, E

AWS Config can detect non-compliant resources and trigger remediation to delete or flag them.

Why this answer

AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer.

Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-level and can be bypassed by administrators) with SCPs (which are organization-wide and cannot be overridden by account admins), leading them to select Option B instead of Option E.

Practice this question →

MCQhard

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

A.Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.

B.Increase the size of the firewall instances to larger instance types to handle more traffic per instance.

C.Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.

D.Configure the auto-scaling group to use a step scaling policy based on network throughput.

AnswerA

Cross-zone load balancing ensures that traffic is balanced across all healthy targets, improving scaling and reducing latency.

Why this answer

Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.

Exam trap

The trap here is that candidates assume Gateway Load Balancers inherently distribute traffic across all Availability Zones like Application Load Balancers do, but in reality, GWLB endpoints are zonal by default and require explicit cross-zone load balancing to spread traffic across AZs.

How to eliminate wrong answers

Option B is wrong because increasing instance size addresses per-instance capacity but does not fix the root cause of uneven traffic distribution across AZs; the firewall may still be overwhelmed in one AZ while others are underutilized, and scaling policies based on aggregate metrics may not trigger correctly. Option C is wrong because creating additional GWLB endpoints per AZ and separate TGW route tables per AZ would actually isolate traffic to each AZ, exacerbating the uneven distribution problem and potentially increasing complexity without solving the scaling issue. Option D is wrong because step scaling policies based on network throughput can help with scaling but do not address the fundamental issue that traffic is not evenly distributed across AZs; without cross-zone load balancing, the auto-scaling group may not scale appropriately because the load is concentrated in one AZ.

Practice this question →

MCQeasy

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

A.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}

B.{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}

C.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}

D.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}

AnswerC

Correct. This Deny policy with a condition on aws:RequestTag/CostCenter being null ensures that any launch without the CostCenter tag is denied, enforcing the requirement.

Why this answer

It uses a Deny effect with a condition that checks if the 'aws:RequestTag/CostCenter' key is null (i.e., not provided). This policy will deny any RunInstances request that does not include the 'CostCenter' tag, effectively requiring the tag to be present at launch. Option A is incorrect because the 'ec2:CreateAction' condition key is unrelated to tag enforcement; it checks the action type, not the presence of a tag.

Option B is incorrect because an Allow policy with a condition does not prevent untagged launches if there are other Allow policies (e.g., a broader Allow without conditions). Option D is incorrect because it denies only when the tag is not equal to a specific value 'MyProject', which does not enforce the presence of the tag but rather a specific value.

Practice this question →

MCQhard

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

A.The SCP does not include an explicit allow for the sts:GetSessionToken action.

B.The IAM policy attached to the users does not allow any actions.

C.The SCP does not apply to users who have administrative privileges.

D.The SCP also denies access to the root user of each account.

AnswerA

Without allowing STS:GetSessionToken, the MFA challenge cannot be completed.

Why this answer

When users authenticate with MFA, the AWS Management Console calls the STS GetSessionToken API to obtain temporary credentials that include the MFA session. If the SCP denies all actions, including sts:GetSessionToken, then even with valid MFA the user cannot obtain the necessary temporary credentials, resulting in access denial. The SCP must explicitly allow the sts:GetSessionToken action for users who authenticate with MFA.

Option B is incorrect because the issue is not about the users' IAM policies but about the SCP. Option C is incorrect because SCPs apply to all principals in the account, including administrators. Option D is incorrect because the SCP does not inherently affect the root user differently; root user is not affected by SCPs in the management account.

Practice this question →

Multi-Selecthard

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Select 3 answers

A.Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.

B.Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.

C.Associate each VPC with the private hosted zone using the authorize zone association API.

D.Use AWS RAM to share the private hosted zone with the other accounts.

E.Create a VPC peering connection between the central account and each VPC.

AnswersB, C, D

IAM permissions control who can perform the association.

Why this answer

Restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.

Exam trap

The trap here is that candidates often confuse VPC peering with DNS resolution; peering provides network connectivity but does not automatically grant DNS resolution from a private hosted zone, which requires explicit association or sharing via AWS RAM.

Practice this question →

MCQeasy

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

A.Use AWS Organizations to create a new IAM user in each member account with full permissions, and disable the root user.

B.Capture the root user email addresses and passwords in a secure password manager and share them with the security team.

C.Use the management account to assume an IAM role in each member account that has permissions to reset the root user password and enable MFA. Then, rotate the root user password and enable MFA.

D.Use AWS Single Sign-On (SSO) to grant the security team access to the root user credentials for each account.

AnswerC

This allows central management without sharing credentials.

Why this answer

It leverages AWS Organizations to create an IAM role in each member account with permissions to reset the root user password and enable MFA. The security team can assume this role from the management account, allowing them to securely manage root user credentials without sharing them. Option A is incorrect because the root user cannot be disabled, and creating an IAM user does not provide access to the root user.

Option B is insecure as it involves sharing root credentials. Option D is incorrect because AWS SSO (now IAM Identity Center) does not manage root user credentials.

Practice this question →

Multi-Selectmedium

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Select 2 answers

A.Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.

B.Set the default encryption on each bucket to disable encryption.

C.Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.

D.Create an IAM policy with a global condition for SSE and attach it to all users and roles.

E.Use AWS Config rules to detect S3 buckets without encryption and automatically remediate.

AnswersA, E

SCPs can deny actions that do not meet conditions, such as requiring encryption.

Why this answer

A service control policy (SCP) can be applied at the AWS Organizations root, OU, or account level to deny S3 bucket operations that do not include encryption. By using a condition key like `s3:x-amz-server-side-encryption` in the SCP, you can enforce that any `s3:PutBucket*` action must specify encryption, preventing the creation or modification of buckets without SSE. This provides a preventive, centralized control that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules with auto-remediation) with preventive controls (like SCPs), but the question specifically asks to 'enforce' the requirement, which demands a preventive approach that blocks non-compliant actions before they occur.

Practice this question →

MCQeasy

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

A.AWS Directory Service for Microsoft Active Directory.

B.AWS Identity and Access Management (IAM) in the management account.

C.AWS IAM Identity Center (AWS SSO).

D.Amazon Cognito user pools.

AnswerC

Provides centralized access management across accounts.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user identities and permissions across multiple AWS accounts within an AWS Organization. It allows the security team to create or connect users and groups, and assign them fine-grained permissions to accounts, roles, and applications from a single pane of glass, eliminating the need to create IAM users in each account.

Exam trap

The trap here is that candidates often confuse IAM Identity Center with simply using IAM in the management account, failing to realize that IAM is account-scoped and cannot centrally manage identities across multiple accounts without additional federation or automation.

How to eliminate wrong answers

Option A is wrong because AWS Directory Service for Microsoft Active Directory is a managed Microsoft AD service used for identity federation and directory-aware workloads, not for centrally managing IAM users and roles across AWS accounts. Option B is wrong because IAM in the management account can only manage users and roles within that single account; it cannot natively manage identities across member accounts without complex cross-account role assumptions and manual duplication. Option D is wrong because Amazon Cognito user pools are designed for customer-facing identity and access management for web and mobile applications, not for managing workforce identities or AWS account access.

Practice this question →

Multi-Selectmedium

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Select 3 answers

A.License configurations

B.Subnets

C.Transit gateways

D.VPC peering connections

E.Security groups

AnswersA, B, C

License Manager configurations can be shared via RAM.

Why this answer

AWS License Manager configurations can be shared across accounts using AWS Resource Access Manager (RAM), enabling centralized management of software licenses. This allows organizations to enforce license usage limits and rules consistently across multiple accounts in an AWS Organization.

Exam trap

The trap here is that candidates often assume VPC peering connections can be shared via RAM because they are a networking construct, but RAM only supports sharing of resources that can be centrally managed and attached to multiple accounts, not point-to-point connections like VPC peering.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First navigate to snapshots, restore, configure settings, wait for completion, then update application endpoint.

Practice this question →

MCQhard

A company uses AWS Organizations with a hierarchical OU structure. The security OU has an SCP that denies all actions except those explicitly allowed. The development OU has an SCP that allows all actions. A developer account in the development OU tries to launch an EC2 instance but receives an access denied error. The IAM user in the developer account has full administrator permissions. What is the most likely cause?

A.An SCP at the root level denies EC2 actions.

B.The SCP at the development OU level denies EC2 actions.

C.The IAM user does not have MFA enabled, and an SCP requires MFA.

D.An SCP at the root level requires encryption on EC2 instances, which is not satisfied.

AnswerA

A restrictive SCP at the root would override the permissive development OU SCP.

Why this answer

The most likely cause is an SCP at the root level that denies EC2 actions. In AWS Organizations, SCPs are evaluated hierarchically: an explicit deny at the root level overrides any allow from a lower-level OU or account-level policy. Even though the development OU has an SCP that allows all actions, the root-level SCP (which denies all actions except those explicitly allowed) will block EC2 actions unless EC2 is explicitly allowed in that root SCP.

The IAM user's full administrator permissions are irrelevant because SCPs act as a permission boundary that cannot be bypassed by account-level IAM policies.

Exam trap

The trap here is that candidates assume the development OU's 'allow all' SCP overrides the root-level SCP, but in AWS Organizations, an explicit deny at any level (especially the root) takes precedence over any allow, and SCPs are not additive—they are evaluated as a union of all applicable SCPs with explicit denies taking priority.

How to eliminate wrong answers

Option B is wrong because the development OU SCP allows all actions, so it does not deny EC2 actions. Option C is wrong because there is no mention of an MFA requirement in the scenario, and even if an SCP required MFA, the error message would typically indicate an MFA issue, not a generic access denied. Option D is wrong because an SCP that requires encryption on EC2 instances would not cause an access denied error on launch; it would either allow the launch (if encryption is configured) or fail at a later stage (e.g., during instance configuration), but the SCP itself would not block the API call unless it explicitly denies the action.

Practice this question →

100

Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Select 2 answers

A.Use AWS Config to record IAM role changes and stream to CloudWatch Logs.

B.Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.

C.Create an SCP that denies IAM role creation and modification.

D.Enable CloudTrail management events with CloudWatch Logs integration in all accounts.

E.Enable IAM Access Analyzer to monitor IAM role usage.

AnswersB, D

Metric filters can parse logs and trigger alarms.

Why this answer

A CloudWatch Logs metric filter can parse CloudTrail logs for specific API calls (e.g., CreateRole, UpdateAssumeRolePolicy) and trigger an alarm when IAM role creation or modification events occur. Option D is correct because enabling CloudTrail management events with CloudWatch Logs integration in all accounts ensures that all IAM role API calls are captured in a centralized log group, which is a prerequisite for the metric filter and alarm to work.

Exam trap

The trap here is that candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), leading them to select Option A instead of the correct combination of CloudTrail and CloudWatch Logs metric filters.

Practice this question →

101

MCQmedium

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

A.Create an SCP that denies all API calls if the user does not have an MFA device.

B.Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.

C.Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.

D.Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.

AnswerB

Config can detect and remediate across accounts.

Why this answer

Deploying an AWS Config rule across all accounts using AWS Organizations allows centralized detection of IAM users without MFA, and using AWS Config custom remediation can automatically disable their access keys. This meets the requirement for central management from the management account. Option A is incorrect because SCPs can deny API calls if MFA is not present, but they cannot disable access keys.

Option C is incorrect because IAM Access Analyzer is used for analyzing access policies and does not have the capability to enforce MFA or disable keys. Option D is incorrect because AWS IAM Identity Center is designed for workforce identity and access management, not for managing existing IAM users in member accounts.

Practice this question →

102

MCQhard

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

A.The trust policy does not include the correct service principal for EC2

B.The IAM role name already exists in the account

C.The template does not have the required IAM capabilities

D.The role does not have an instance profile

AnswerB

IAM role names must be unique within an account.

Why this answer

The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Exam trap

The trap here is that candidates often confuse 'Resource creation cancelled' with permission or policy errors, but it specifically indicates a conflict or failure during resource creation, such as a duplicate name, rather than a missing capability or incorrect trust policy.

How to eliminate wrong answers

Option A is wrong because an incorrect trust policy would cause a different error, such as 'Invalid principal in policy' or a validation failure, not 'Resource creation cancelled'. Option C is wrong because missing IAM capabilities (like CAPABILITY_IAM) would result in an explicit error message stating that the template requires IAM capabilities, not a 'Resource creation cancelled' error. Option D is wrong because an instance profile is not required for creating an IAM role; it is only needed when associating the role with an EC2 instance, and its absence would not cause the role creation to fail.

Practice this question →

103

Multi-Selecteasy

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Select 3 answers

A.Create an IAM role in each member account that allows CloudFormation to create resources.

B.Create an SCP that allows CloudFormation to create S3 buckets.

C.Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.

D.Create a CloudFormation StackSet in the management account.

E.Configure the StackSet with the target accounts and regions, and specify an IAM role for execution.

AnswersC, D, E

The template defines the resources to be created.

Why this answer

The CloudFormation template must define the S3 bucket resource with default encryption enabled (e.g., using the `BucketEncryption` property with `AES256` or `aws:kms`) to meet the requirement. Without this configuration in the template, the deployed bucket would not have default encryption, failing the central team's objective.

Exam trap

The trap here is that candidates confuse SCPs with IAM policies, assuming SCPs can grant permissions to CloudFormation, when in fact SCPs only restrict permissions and the actual execution relies on an IAM role assumed by StackSets.

Practice this question →

104

Multi-Selectmedium

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Select 2 answers

A.Create an IAM Identity Center identity store and manually import users from Active Directory.

B.Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.

C.Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.

D.Create permission sets in IAM Identity Center for each job function and assign them to groups.

E.Configure AWS CloudTrail to log all sign-in events.

AnswersB, D

Managed AD integrates with IAM Identity Center.

Why this answer

AWS IAM Identity Center can use AWS Managed Microsoft AD as its identity source, enabling seamless synchronization of users and groups from an existing on-premises Active Directory via a two-way forest trust. This eliminates the need for manual import and provides a managed, highly available directory service that integrates directly with IAM Identity Center for single sign-on across multiple AWS accounts.

Exam trap

The trap here is that candidates often confuse AD Connector (which only proxies authentication) with AWS Managed Microsoft AD (which provides a full directory that can be synchronized with IAM Identity Center), leading them to incorrectly select option C as a valid identity source for IAM Identity Center.

Practice this question →

105

MCQmedium

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

A.Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.

B.Use AWS Config rules to enforce the IAM role creation in each account.

C.Manually create the IAM role in each account using the AWS Management Console.

D.Use AWS Organizations to create the IAM role via a service control policy (SCP).

AnswerA

StackSets automate deployment across multiple accounts.

Why this answer

AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Exam trap

The trap here is confusing AWS Config rules (detective control) with proactive resource creation, or assuming SCPs can create IAM roles when they only enforce permission boundaries.

How to eliminate wrong answers

Option B is wrong because AWS Config rules can only detect non-compliance (e.g., missing IAM role) and trigger remediation actions, but they do not directly create the IAM role; they require a separate automation (e.g., Lambda) to create it, making it less efficient than StackSets. Option C is wrong because manually creating the IAM role in each account using the AWS Management Console is inefficient, error-prone, and does not scale for multi-account environments. Option D is wrong because AWS Organizations service control policies (SCPs) are used to restrict permissions, not to create IAM roles; SCPs cannot create resources like IAM roles.

Practice this question →

106

Multi-Selectmedium

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

Select 3 answers

A.Enable detailed billing reports in the management account.

B.Enable the RI discount sharing feature in the management account.

C.Activate cost allocation tags in the Billing and Cost Management console.

D.Enable AWS Cost and Usage Reports (CUR) for each member account.

E.Define and enforce a tagging strategy using AWS Organizations tag policies.

AnswersB, C, E

RI sharing allows cost benefits to be shared across accounts.

Why this answer

Enabling RI discount sharing in the management account allows all accounts in the AWS Organization to benefit from Reserved Instance discounts, which is essential for accurate cost allocation across departments. Without this, RI discounts would only apply to the purchasing account, skewing department-level cost tracking.

Exam trap

The trap here is that candidates often think detailed billing reports or per-account CUR are needed for granular cost tracking, but AWS Organizations requires CUR and tag policies to be configured at the management account level for consolidated, department-level cost allocation.

Practice this question →

107

Multi-Selecthard

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Select 3 answers

A.Use AWS Config aggregator in the security account to collect configuration items from all accounts.

B.Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.

C.Enable Amazon GuardDuty in the security account and add member accounts via the GuardDuty API.

D.Enable AWS IAM Access Analyzer in the security account with the organization as the zone of trust.

E.Configure GuardDuty in the security account to monitor all regions by using a single detector.

AnswersB, C, D

Security Hub administrator account aggregates findings.

Why this answer

AWS Security Hub supports multi-account management by designating a central administrator account (the security account) that aggregates findings from all member accounts across the organization. This is done through AWS Organizations integration, enabling automatic enrollment of all accounts and regions without manual setup.

Exam trap

The trap here is that candidates may confuse AWS Config aggregator (which aggregates configuration data) with security finding aggregation, or think that simply enabling a service in the security account automatically pulls findings from member accounts without explicitly designating the administrator account or adding members.

Practice this question →

108

MCQeasy

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

A.Enable CloudTrail Insights in each account and review separately.

B.Use AWS Config aggregator to collect IAM user activity.

C.Set up Amazon Kinesis Data Streams in each account and stream to a central Kinesis Data Firehose.

D.Configure CloudTrail in each account to deliver logs to a single S3 bucket in the security account.

AnswerD

This centralizes logs without additional tooling.

Why this answer

CloudTrail can be configured in each account to deliver log files to a centralized S3 bucket in the security account. This approach aggregates all IAM user activities into a single location without requiring additional streaming infrastructure, and it scales automatically as new accounts are added. The central security team can then use Amazon Athena or AWS Lake Formation to query the logs across all accounts efficiently.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Kinesis (Option C) because they assume streaming is required for scalability, but CloudTrail's native S3 delivery is the most scalable and cost-effective aggregation method for IAM user activity logs.

How to eliminate wrong answers

Option A is wrong because reviewing CloudTrail Insights separately in each account does not aggregate logs; it requires manual per-account access and lacks a centralized view, making it unscalable for decentralized IT structures. Option B is wrong because AWS Config aggregator is designed to collect resource configuration changes and compliance history, not IAM user activity logs; CloudTrail is the service that records API activity, not AWS Config. Option C is wrong because setting up Kinesis Data Streams in each account and streaming to a central Kinesis Data Firehose introduces unnecessary complexity, cost, and operational overhead compared to the simpler S3 bucket delivery method; CloudTrail can directly deliver to S3 without needing Kinesis.

Practice this question →

109

MCQhard

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

A.Use a Lambda function in each account to copy logs to the central bucket

B.Set up S3 cross-account replication from each account's bucket to the central bucket

C.Configure VPC Flow Logs in each account to directly deliver to the central bucket

D.Use CloudWatch Logs subscription filter to stream logs to the central account

AnswerB

Replication is automated and efficient.

Why this answer

S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Exam trap

The trap here is that candidates assume VPC Flow Logs can be delivered directly to a cross-account S3 bucket (Option C), but AWS restricts delivery to the same account, making replication the only native, serverless way to centralize logs across accounts.

How to eliminate wrong answers

Option A is wrong because using a Lambda function in each account to copy logs introduces unnecessary complexity, potential for execution timeouts, and additional cost per invocation, making it less efficient than a managed replication service. Option C is wrong because VPC Flow Logs can only deliver to an S3 bucket in the same account as the VPC; direct delivery to a cross-account bucket is not supported by the VPC Flow Logs service. Option D is wrong because CloudWatch Logs subscription filters are designed to stream logs to a central CloudWatch Logs account or to other destinations like Lambda or Kinesis, not directly to an S3 bucket, and would require additional transformation steps to land in S3.

Practice this question →

110

MCQeasy

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

A.Use an AWS Config aggregator to deploy rules across accounts.

B.Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

C.Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.

D.Use AWS Config to create a custom rule in each account manually.

AnswerC

Conformance packs allow consistent deployment of rules across accounts and regions.

Why this answer

AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Exam trap

The trap here is that candidates confuse the purpose of an AWS Config aggregator (which only aggregates compliance data) with the ability to deploy rules, leading them to select Option A, while Option B seems plausible but misses that conformance packs are the purpose-built, more maintainable solution for deploying a common set of rules at scale.

How to eliminate wrong answers

Option A is wrong because an AWS Config aggregator is used to aggregate compliance data from multiple accounts and Regions into a single view; it does not deploy or manage Config rules across accounts. Option B is wrong because while CloudFormation StackSets can deploy individual Config rules, conformance packs are the recommended service for deploying a common set of rules with built-in support for organization-wide management, parameterization, and remediation actions, making them more maintainable than deploying individual rules. Option D is wrong because manually creating custom rules in each account is not scalable, introduces human error, and violates the principle of infrastructure as code and centralized management.

Practice this question →

111

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

A.Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

B.Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

C.Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.

D.Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

AnswerC

SCPs can enforce conditions on API actions across all accounts in the organization.

Why this answer

A service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Exam trap

The trap here is that candidates often confuse detective controls (like CloudTrail and CloudWatch alarms) with preventive controls (like SCPs), or mistakenly think IAM policies can enforce request headers on API actions, when only SCPs can centrally enforce such conditions across multiple accounts.

How to eliminate wrong answers

Option A is wrong because an IAM role with a policy requiring encryption attached to all users does not prevent users from creating buckets without encryption—IAM policies control who can perform actions, but they cannot enforce request headers on the s3:CreateBucket action; users could still create unencrypted buckets by omitting the encryption header. Option B is wrong because configuring bucket policies on each existing bucket only affects access to those specific buckets, not the creation of new buckets; it cannot enforce encryption on newly created buckets. Option D is wrong because enabling CloudTrail and CloudWatch alarms is a detective control, not a preventive one—it only notifies after an unencrypted bucket is created, failing to enforce encryption at creation time.

Practice this question →

112

MCQmedium

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

A.Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.

B.Use AWS Systems Manager Automation to apply the baseline to new accounts.

C.Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.

D.Use AWS Config aggregators to apply the baseline controls to new accounts.

AnswerC

StackSets can deploy stacks across multiple accounts and regions, and can be set to automatically apply to new accounts.

Why this answer

AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.

Exam trap

The trap here is confusing SCPs (which only restrict permissions) with actual resource deployment mechanisms, leading candidates to incorrectly choose Option A because they think SCPs can 'enforce' the presence of services like CloudTrail.

How to eliminate wrong answers

Option A is wrong because Service Control Policies (SCPs) are used to define permission boundaries and restrict actions, not to deploy or enable services like CloudTrail or AWS Config rules; SCPs cannot create resources or enable services. Option B is wrong because AWS Systems Manager Automation is designed for operational tasks on existing instances or accounts, not for automatically provisioning baseline resources across new accounts as they join an organization. Option D is wrong because AWS Config aggregators only collect and aggregate compliance data from multiple accounts and regions; they do not deploy or enable Config rules or other security controls.

Practice this question →

113

MCQmedium

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

A.All principals outside the organization are denied all actions.

B.All principals are required to have MFA enabled.

C.All principals in the organization are allowed all actions.

D.All principals in the organization are denied all actions.

AnswerA

The condition denies when the org ID does not match, so external principals are blocked.

Why this answer

The SCP explicitly denies all actions (`ec2:*`, `s3:*`, etc.) to any principal outside the organization by using a `Condition` block with `aws:PrincipalOrgID` set to the organization's ID. This effectively blocks any request from an IAM user, role, or federated principal that is not a member of the specified AWS Organization. The `Deny` effect overrides any allow, so all actions are denied for external principals.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming SCPs grant permissions (like Option C) or apply to all principals equally (like Option D), when in fact SCPs only deny or allow permissions and are evaluated separately from IAM policies.

How to eliminate wrong answers

Option B is wrong because the SCP does not include any condition requiring MFA; it only denies actions based on the `aws:PrincipalOrgID` condition. Option C is wrong because the SCP does not grant any permissions; it only denies actions to external principals, and by default, SCPs do not allow actions—they only restrict them. Option D is wrong because the SCP only denies actions to principals outside the organization, not to principals inside the organization; internal principals are unaffected by this policy.

Practice this question →

114

MCQhard

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

A.Create a Lambda function in each member account to redact logs before delivery.

B.Use S3 Object Lambda to redact sensitive data when objects are read.

C.Use Amazon Athena with Lambda User-Defined Functions (UDFs) to redact data during query execution.

D.Use Amazon Kinesis Data Firehose to transform data before writing to S3.

AnswerC

Scalable and flexible; allows redaction on the fly without modifying stored data.

Why this answer

Amazon Athena with Lambda UDFs allows you to redact sensitive IP addresses at query time without modifying the underlying data in S3. This approach is highly scalable as it leverages Athena's serverless query engine and Lambda's stateless compute, enabling on-the-fly redaction across petabytes of VPC Flow Logs stored centrally in the logging account.

Exam trap

The trap here is that candidates often confuse S3 Object Lambda (which modifies data at read time for all access) with query-time redaction, failing to realize that Athena UDFs provide a more scalable and cost-effective solution for selective redaction during analysis without affecting other consumers of the data.

How to eliminate wrong answers

Option A is wrong because deploying a Lambda function in each member account to redact logs before delivery would require managing multiple functions and would not scale efficiently; it also violates the centralized logging design by altering data before it reaches the central S3 bucket. Option B is wrong because S3 Object Lambda redacts data when objects are read, but it applies to all read requests, which can introduce latency and cost overhead for every query, and it does not integrate natively with Athena for query-time redaction. Option D is wrong because Amazon Kinesis Data Firehose transforms data before writing to S3, but the VPC Flow Logs are already delivered directly to S3 from member accounts; inserting Firehose would require changing the delivery pipeline and adds complexity without addressing the need for query-time redaction.

Practice this question →

115

MCQhard

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

A.Use the Amazon EC2 'Block public access' feature at the account level.

B.Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.

C.Use AWS Config to detect instances with public IPs and automatically terminate them.

D.Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.

AnswerD

SCPs are preventive and cannot be overridden by IAM policies within the account.

Why this answer

A service control policy (SCP) attached to the production OU can deny the ec2:RunInstances action when the request includes the AssociatePublicIpAddress=true parameter. This is a preventive control that applies to all accounts in the OU, regardless of IAM permissions, and does not rely on developer compliance.

Exam trap

The trap here is confusing detective controls (AWS Config) or account-level features (Block public access) with preventive controls, and underestimating that IAM policies can be circumvented by privileged users or service-linked roles, whereas SCPs apply to all principals in the account.

How to eliminate wrong answers

Option A is wrong because the Amazon EC2 'Block public access' feature is not a preventive control at the account level; it only applies to internet-facing load balancers and not to EC2 instances directly. Option B is wrong because an IAM policy attached to roles can be bypassed if developers create new roles or use other credentials, and it does not prevent actions taken by the root user or services that assume roles outside the policy scope. Option C is wrong because AWS Config is a detective control that triggers remediation after the fact, not a preventive control; it cannot stop the instance from being launched with a public IP.

Practice this question →

116

MCQhard

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

A.Configure the external IdP to send a SAML attribute that AWS uses to enforce permissions.

B.Use AWS SSO to assign the finance group to the finance OU accounts only.

C.Create an SCP that denies access to non-finance accounts for users from the finance group.

D.Create IAM roles in each finance account and trust the IdP with a condition on the group attribute.

AnswerB

AWS SSO provides direct assignment of users/groups to accounts.

Why this answer

AWS SSO (now AWS IAM Identity Center) allows you to assign users or groups to specific AWS accounts and OUs directly. By assigning the finance group only to the finance OU accounts, you enforce that those users can only access those accounts via the SSO portal, without needing additional SAML attributes or SCPs. This is the simplest and most direct method for controlling account access based on group membership.

Exam trap

The trap here is that candidates often overcomplicate the solution by thinking they need to modify SAML attributes or create custom IAM roles, when AWS SSO's built-in group-to-account assignment is the simplest and most secure method for controlling access to specific OUs.

How to eliminate wrong answers

Option A is wrong because AWS SSO does not use SAML attributes from the external IdP to enforce permissions on which accounts a user can access; instead, it relies on group-to-account assignments within the SSO configuration. Option C is wrong because SCPs (Service Control Policies) apply to all principals in an account and cannot distinguish between users from different groups within the same account; they are used to restrict service actions, not to control which accounts a user can sign into. Option D is wrong because creating IAM roles in each finance account that trust the IdP with a condition on the group attribute would require managing roles across many accounts and does not leverage AWS SSO's centralized assignment model, making it more complex and less secure than the native SSO group assignment.

Practice this question →

117

Multi-Selectmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers

A.Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.

B.Use AWS Config rules to detect root user usage.

C.Create an IAM role for root user with limited permissions.

D.Enable AWS CloudTrail to log root user API calls in all accounts.

E.Attach a service control policy (SCP) to all accounts to deny root user actions.

AnswersA, D

Alerts on root user activity.

Why this answer

Amazon CloudTrail logs root user login events as 'RootLogin' events, which can be captured by an Amazon CloudWatch Events rule (now Amazon EventBridge). This rule can trigger an Amazon SNS notification to alert the security team in real time, ensuring immediate awareness of root activity. Option D is correct because AWS CloudTrail must be enabled in all accounts to record root user API calls; without CloudTrail, there is no audit trail for root actions, making monitoring impossible.

Exam trap

The trap here is that candidates may think SCPs can restrict root user actions, but AWS explicitly exempts the root user from SCPs, making option E ineffective for monitoring or prevention.

Practice this question →

118

MCQeasy

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

A.Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.

B.Use AWS Budgets to alert on untagged resources.

C.Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.

D.Create an AWS Lambda function that tags resources after they are created.

AnswerA

SCPs can enforce tag requirements proactively.

Why this answer

A service control policy (SCP) can be applied at the root, OU, or account level in AWS Organizations to deny the creation of resources that do not have the required cost allocation tags. This enforces tagging proactively at the API call level, preventing untagged resources from being created in the first place, which is the most effective approach for central enforcement.

Exam trap

The trap here is that candidates often choose reactive solutions (like AWS Config or Lambda) because they seem automated, but the question asks for the 'most effective' solution, which requires proactive enforcement via SCPs to prevent untagged resources from ever existing.

How to eliminate wrong answers

Option B is wrong because AWS Budgets can only send alerts based on cost or usage thresholds; it cannot enforce or prevent the creation of untagged resources. Option C is wrong because AWS Config rules are reactive — they detect non-compliant resources after creation and can trigger remediation, but they do not prevent the resource from being created, leaving a window for untagged resources to exist. Option D is wrong because a Lambda function that tags resources after creation is also reactive and cannot guarantee that all resources are tagged before they incur cost or are used, and it may fail if the resource type does not support post-creation tagging.

Practice this question →

119

MCQmedium

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

A.An SCP that allows only read-only billing actions.

B.An SCP that denies all billing-related actions except read-only.

C.An IAM policy attached to the root OU that denies billing modifications.

D.An SCP that denies the effect of actions that modify billing preferences.

AnswerD

An SCP can deny actions like 'aws-portal:ModifyAccount' and 'aws-portal:ModifyBilling'.

Why this answer

A Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Exam trap

The trap here is that candidates confuse SCPs with IAM policies, thinking an IAM policy can be attached to an OU, or they incorrectly assume that an Allow-only SCP is the simplest way to restrict actions, when in reality a targeted Deny SCP is more precise and maintainable for blocking specific modification actions while allowing all other billing read actions by default.

How to eliminate wrong answers

Option A is wrong because an SCP that allows only read-only billing actions would require an explicit Allow statement for every read-only action, which is brittle and could inadvertently block necessary read-only actions if the list is incomplete; moreover, SCPs are deny-by-default, so an Allow-only SCP would effectively deny all other actions, but it is not the most precise or maintainable approach for this requirement. Option B is wrong because an SCP that denies all billing-related actions except read-only would require an explicit Deny for every non-read-only action, which is cumbersome and error-prone; a Deny list approach is less scalable than using a Deny on specific modification actions as in Option D. Option C is wrong because an IAM policy cannot be attached to an OU; IAM policies are attached to IAM users, groups, or roles, not to organizational units in AWS Organizations, so this option is technically invalid.

Practice this question →

120

Multi-Selectmedium

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

Select 2 answers

A.Use AWS Service Catalog to create a product that launches approved instances, and require developers to launch only through Service Catalog.

B.Apply a service control policy (SCP) that denies ec2:RunInstances with an ec2:InstanceType condition key that does not match approved families.

C.Deploy an AWS Config rule that triggers a Lambda function to terminate unauthorized instances.

D.Create an IAM role in each account with a policy that restricts instance types, and require developers to use that role.

E.Use AWS CloudFormation StackSets to deploy an IAM policy across accounts that denies ec2:RunInstances for non-approved types.

AnswersB, E

Prevents unauthorized instance types at the organizational level.

Why this answer

A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny ec2:RunInstances for non-approved instance types using the ec2:InstanceType condition key. This enforces the restriction across all accounts without requiring per-account IAM changes, and SCPs act as a guardrail that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that IAM roles or Service Catalog alone can enforce restrictions across all access methods without additional guardrails.

Practice this question →

121

MCQmedium

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

A.Use Amazon QuickSight to create dashboards from the flow logs.

B.Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.

C.Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

D.Load the flow logs into Amazon Redshift and run SQL queries.

AnswerB

Athena is serverless and cost-effective for ad-hoc querying of S3 data.

Why this answer

Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Exam trap

The trap here is that candidates may choose Redshift or Kinesis because they associate 'analysis' with traditional data warehouses or real-time processing, overlooking that Athena's serverless, pay-per-query model is the most cost-effective and scalable for ad-hoc SQL analysis of data already in S3.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a visualization tool that requires a data source; it cannot directly analyze raw VPC flow logs in S3 without an intermediate query engine like Athena, and it incurs per-session costs that are not optimal for ad-hoc analysis. Option C is wrong because Amazon Kinesis Data Analytics processes streaming data in real time, which is unnecessary and more expensive for analyzing historical VPC flow logs already stored in S3; the requirement is for batch analysis of stored logs, not real-time processing. Option D is wrong because loading VPC flow logs into Amazon Redshift involves data ingestion, storage, and compute costs even when not querying, and it requires cluster management, making it less cost-effective and more complex than Athena's serverless approach for this use case.

Practice this question →

122

Multi-Selectmedium

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Select 2 answers

A.Create an SCP that denies s3:PutObject unless encryption headers are included.

B.Create an SCP that requires all objects to be uploaded with server-side encryption.

C.Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.

D.Create an SCP that denies the s3:CreateBucket action to all accounts.

E.Use AWS Config rules to detect buckets without default encryption and auto-remediate with a Lambda function.

AnswersA, E

Correct. An SCP can deny s3:PutObject unless encryption headers are present using the condition key s3:x-amz-server-side-encryption, enforcing encryption on uploads across all accounts.

Why this answer

An SCP can deny the s3:PutObject action unless encryption headers are included, using the condition key s3:x-amz-server-side-encryption. This enforces server-side encryption on all object uploads across the organization. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable it, ensuring compliance.

Option C is incorrect because S3 Block Public Access does not enforce encryption; it only prevents public access. Option B is incorrect because SCPs cannot 'require' encryption in the sense of enabling it; they can only deny non-compliant requests, making Option A the precise action. Option D is incorrect because denying CreateBucket does not enforce encryption on existing buckets.

Exam trap

A common trap is to think that S3 Block Public Access (Option C) enforces encryption, but it only blocks public access. Encryption must be explicitly required via SCPs or Config rules.

Practice this question →

123

MCQhard

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

A.Use IAM policies in each account to restrict the AMI ID

B.Use AWS Config rules with auto-remediation to stop non-compliant instances

C.Use a service control policy (SCP) that denies EC2 RunInstances unless the AMI ID matches the approved list

D.Use CloudFormation StackSets to enforce AMI IDs for all new instances

AnswerC

SCPs can centrally control which AMIs can be used across all accounts.

Why this answer

A service control policy (SCP) can centrally deny the EC2 RunInstances action across all accounts in an AWS Organization unless the request specifies an AMI ID from an approved list. SCPs act as a permission guardrail that cannot be overridden by account-level IAM policies, making them the only mechanism that enforces a mandatory AMI ID across 200 accounts without relying on post-launch detection or per-account configuration.

Exam trap

The trap here is that candidates confuse reactive compliance tools like AWS Config (which detects violations after the fact) with proactive preventive controls like SCPs (which block the action before it happens), leading them to choose Option B instead of C.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be overridden by an account administrator with full administrative privileges, and managing 200 separate IAM policies is operationally unscalable and does not provide a centralized enforcement mechanism. Option B is wrong because AWS Config rules with auto-remediation are reactive—they detect non-compliant instances after launch and then attempt to stop them, which allows a window of non-compliance and can be bypassed if the remediation action fails or is delayed. Option D is wrong because CloudFormation StackSets can deploy templates that specify AMI IDs, but they cannot prevent users from launching EC2 instances outside of CloudFormation using the console, CLI, or SDK, so they do not enforce the AMI ID requirement universally.

Practice this question →

124

MCQhard

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

A.Yes, because the Deny statement only applies to non-encrypted requests.

B.Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.

C.No, because the Deny statement blocks all HTTP requests regardless of encryption.

D.No, because the Allow statement requires HTTPS transport.

AnswerC

The Deny condition is on SecureTransport false, so any HTTP request is denied.

Why this answer

The Deny statement in the policy explicitly blocks all HTTP requests (using `aws:SecureTransport`: false) regardless of whether the request uses SSE-S3 encryption. Since the user is uploading via an unencrypted HTTP connection, the Deny statement matches and overrides any Allow statement, causing the upload to fail. AWS IAM policy evaluation is explicit deny by default, so the Deny takes precedence.

Exam trap

The trap here is that candidates often focus on the encryption requirement (SSE-S3) and overlook the explicit Deny for HTTP transport, mistakenly thinking that encryption alone satisfies all conditions, when in fact the Deny for insecure transport takes precedence.

How to eliminate wrong answers

Option A is wrong because the Deny statement does not only apply to non-encrypted requests; it specifically blocks HTTP requests (non-HTTPS), and the request uses HTTP, so it is denied regardless of encryption. Option B is wrong because while the Allow statement permits requests with SSE-S3 encryption, the Deny statement for HTTP requests overrides it; IAM denies take precedence over allows. Option D is wrong because the Allow statement does not require HTTPS transport; it only requires SSE-S3 encryption and does not mention HTTPS, so the misconception is that HTTPS is required when it is not explicitly stated.

Practice this question →

125

Multi-Selecthard

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Select 3 answers

A.Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.

B.Create a service control policy (SCP) that denies creation of VPCs with non-compliant CIDR blocks.

C.Create an IAM role in each account with permissions to manage VPCs.

D.Set up AWS Lambda functions to terminate noncompliant VPCs daily.

E.Use AWS Config rules to detect and report noncompliant VPCs.

AnswersA, B, E

Automates deployment of compliant infrastructure.

Why this answer

AWS CloudFormation StackSets allows you to deploy infrastructure as code across multiple accounts and Regions from a single administrative account. By defining a standard VPC and subnet configuration in a CloudFormation template and using StackSets, the central IT team can consistently provision compliant network resources in all accounts, ensuring adherence to the standard.

Exam trap

The trap here is that candidates may confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that reactive termination via Lambda is an acceptable enforcement strategy, when the question specifically asks for steps to 'enforce' the standard, which requires preventive or proactive mechanisms.

Practice this question →

126

MCQhard

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

A.Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

B.Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.

C.Use resource-based policies on all AWS resources to deny access from other regions.

D.Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

AnswerB

SCPs prevent resource creation in disallowed regions; Config detects violations.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Exam trap

The trap here is that candidates often confuse network-level controls (like PrivateLink or VPC endpoints) with governance-level controls (like SCPs), mistakenly believing that restricting network traffic is sufficient to enforce data residency, when in fact only SCPs can prevent resource creation in disallowed regions at the API level.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink and VPC endpoints keep network traffic within the AWS network and can restrict traffic to a specific region, but they do not prevent users or services from creating resources in other regions; they only control data plane traffic, not the control plane actions that create resources. Option C is wrong because resource-based policies (e.g., S3 bucket policies, IAM role trust policies) can restrict access based on source IP or VPC endpoint, but they cannot deny the creation of resources in other regions; they only control access to existing resources, not the provisioning of new ones. Option D is wrong because AWS WAF and AWS Shield are security services focused on protecting web applications from common exploits and DDoS attacks; they do not provide any mechanism to enforce geographic data residency or restrict resource creation to specific regions.

Practice this question →

127

MCQmedium

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

A.Use AWS PrivateLink to route traffic through the NGFW.

B.Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.

C.Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

D.Set up AWS Direct Connect between all VPCs and the inspection VPC.

AnswerB

This forces all inter-VPC traffic to go through the inspection VPC.

Why this answer

It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Exam trap

The trap here is that candidates often assume VPC peering (Option C) can be used for transitive routing, but VPC peering does not support transitive routing, making it impossible to route traffic through an inspection VPC to other VPCs.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is designed for private connectivity to services via Network Load Balancers, not for routing inter-VPC traffic through a centralized NGFW; it does not support transitive routing or traffic inspection between VPCs. Option C is wrong because VPC peering does not support transitive routing, so you cannot route traffic from one peered VPC through another VPC to reach a third VPC; this would require a full mesh of peering connections and complex route tables, which is inefficient and not scalable. Option D is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a solution for routing traffic between VPCs; it does not provide inter-VPC routing capabilities and would add unnecessary cost and complexity.

Practice this question →

128

MCQmedium

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

A.Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.

B.Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

C.Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

D.In the source account, create a KMS key and allow the logging account to use it for encryption.

AnswerA

The service principal is 'delivery.logs.amazonaws.com' and needs both bucket and key permissions.

Why this answer

VPC Flow Logs can be published to an S3 bucket in a different account by using a resource-based bucket policy that grants the VPC Flow Logs service principal (delivery.logs.amazonaws.com) write access. Additionally, since the logs must be encrypted at rest with a KMS key in the logging account, the KMS key policy must also grant the same service principal the kms:Encrypt and kms:Decrypt permissions. This combination allows the cross-account delivery service to write encrypted objects directly into the logging account's bucket.

Exam trap

The trap here is that candidates often assume cross-account delivery requires an IAM role (Option B) or that the source account must own the encryption key (Option D), but the correct mechanism uses resource-based policies on the destination bucket and KMS key, not role assumption or source-side key ownership.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs delivery does not use IAM roles for cross-account access; it relies on resource-based policies (bucket policy and KMS key policy) rather than assuming a role. Option C is wrong because the source account's S3 bucket policy is irrelevant; VPC Flow Logs are delivered directly to the logging account's bucket, not written to a source bucket and then replicated. Option D is wrong because using a KMS key in the source account would not allow the logging account to control encryption; the requirement is that the KMS key resides in the logging account, and the source account's key cannot be used for cross-account delivery without additional complex cross-account key grants, which is not the standard approach.

Practice this question →

129

MCQhard

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

A.Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.

B.Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.

C.Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.

D.Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.

AnswerD

This option combines StackSets' automatic drift detection and remediation to correct any drift across all accounts, along with an SCP to deny unauthorized VPC modifications. This ensures consistent configuration and prevents manual changes, making it the most efficient and secure solution.

Why this answer

The most efficient and secure solution because it uses StackSets drift detection with automatic remediation to continuously detect and correct any deviations from the intended VPC configuration across all accounts. Additionally, applying an SCP that denies VPC-related actions (e.g., ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute) unless performed by the StackSet's service role prevents unauthorized changes at the organization level. Option A is reactive and does not prevent drift; Option B requires manual provisioning and does not enforce consistent configuration automatically; Option C requires custom coding (Lambda function) and is less integrated than StackSets' built-in remediation.

Practice this question →

130

MCQhard

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

A.Use a service control policy (SCP) to enforce the creation of the role.

B.Manually create the same IAM role in each account with a trust policy pointing to the security account.

C.Use IAM groups in the security account and grant permissions to the groups.

D.Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.

AnswerD

StackSets automate deployment across accounts and trusted access simplifies cross-account roles.

Why this answer

AWS CloudFormation StackSets allows you to deploy the same IAM role across multiple accounts in an AWS Organization in a single, automated operation. By enabling trusted access with AWS Organizations, the role can be centrally managed and automatically deployed to new accounts as they are added, ensuring the solution scales without manual intervention.

Exam trap

The trap here is that candidates may think SCPs can enforce resource creation (Option A) or that IAM groups can be used for cross-account access (Option C), but SCPs only deny or allow actions and IAM groups are account-scoped, not cross-account.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) can only restrict permissions, not enforce the creation of a specific IAM role; SCPs cannot create resources. Option B is wrong because manually creating the same IAM role in each account does not scale to hundreds of accounts and introduces human error and maintenance overhead. Option C is wrong because IAM groups exist only within a single account and cannot grant cross-account access; cross-account access requires IAM roles with trust policies, not groups.

Practice this question →

131

Multi-Selecthard

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Select 3 answers

A.Allow each team to create their own VPCs and use VPC Peering to connect them.

B.Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.

C.Create a dedicated network account and use AWS Resource Access Manager to share subnets with other accounts.

D.Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

E.Use AWS Firewall Manager to apply common security group rules across all accounts.

AnswersB, C, E

This allows central inspection and control of traffic between VPCs.

Why this answer

Deploying a centralized inspection VPC with AWS Network Firewall and using Transit Gateway to route traffic allows the company to centralize network administration and enforce common security rules across all VPCs. Transit Gateway acts as a hub for inter-VPC and on-premises connectivity, while AWS Network Firewall provides stateful inspection and filtering for all traffic passing through the hub, meeting the requirement for a common set of security rules.

Exam trap

The trap here is that candidates may confuse AWS CloudFormation StackSets (which only automates resource deployment) with centralized security enforcement, overlooking the need for a hub-and-spoke architecture with a centralized inspection point like AWS Network Firewall and Transit Gateway.

Practice this question →

132

MCQhard

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

A.Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.

B.Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

C.Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

D.Use AWS Config rules to detect non-compliant instances and automatically terminate them.

AnswerA

Preventive at the API level and works for CloudFormation deployments.

Why this answer

SCPs provide preventive, account-level enforcement that blocks unauthorized EC2 instance launches before they occur, while CloudFormation hooks add a second layer of preventive control at the infrastructure-as-code level. This combination is the most scalable for 500+ accounts because SCPs are applied centrally via AWS Organizations and CloudFormation hooks operate at deployment time, ensuring no non-compliant instance is ever created.

Exam trap

The trap here is that candidates often choose reactive options like AWS Config or Lambda-based termination because they seem simpler, but the question asks for the 'MOST scalable and effective enforcement,' which requires preventive controls (SCPs and CloudFormation hooks) that block non-compliant launches entirely, rather than cleaning up after the fact.

How to eliminate wrong answers

Option B is wrong because CloudTrail-triggered Lambda is a reactive, post-launch mechanism that incurs cost and latency, and it cannot prevent the initial creation of non-compliant instances, making it less effective than preventive controls. Option C is wrong because Systems Manager scanning and tagging is purely detective and does not enforce compliance; it only identifies non-compliant instances after they exist, without any automatic remediation or prevention. Option D is wrong because AWS Config rules are detective and can trigger auto-remediation (e.g., termination), but they are reactive and may allow non-compliant instances to run for a period, whereas SCPs and CloudFormation hooks block the action at the point of request.

Practice this question →

133

Multi-Selectmedium

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

Select 2 answers

A.Amazon CloudWatch Logs with cross-account log groups.

B.Amazon SQS.

C.Amazon S3 with a centralized bucket and appropriate bucket policies.

D.AWS CloudFormation.

E.Amazon Kinesis Data Firehose.

AnswersA, C

CloudWatch Logs can aggregate logs from multiple accounts.

Why this answer

Amazon CloudWatch Logs supports cross-account log groups, allowing you to stream log data from multiple AWS accounts into a centralized CloudWatch Logs account. This is achieved by configuring destination policies and subscription filters that forward log events across accounts, enabling unified monitoring and alerting without needing to aggregate logs into a single bucket.

Exam trap

The trap here is that candidates may think Amazon S3 alone is insufficient for centralized logging, but with proper bucket policies and cross-account permissions, it is a valid and commonly used solution, while Amazon Kinesis Data Firehose is often mistakenly chosen because it handles streaming data, but it is not a logging destination itself.

Practice this question →

134

Multi-Selecthard

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

Select 3 answers

A.Use AWS Organizations to define a tag policy that mandates the cost center tag.

B.Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.

C.Use AWS CloudFormation templates that enforce tagging and use StackSets to deploy across accounts.

D.Create a service control policy (SCP) that denies resource creation if the required tag is not present, for supported services.

E.Enable AWS Cost Explorer to report on untagged resources.

AnswersA, C, D

Tag policies can enforce tags on resources during creation and prevent non-compliant resource creation.

Why this answer

AWS Organizations tag policies allow you to define rules for tagging resources across accounts in your organization. By specifying the cost center tag as mandatory in a tag policy, you can enforce that all resources must have this tag, and any non-compliant resources can be reported or prevented from being created, depending on the policy's enforcement mode.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like tag policies or SCPs), and may select option B thinking it enforces tagging, when it only remediates after the fact.

Practice this question →

135

MCQmedium

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

A.Partition by region and date.

B.Partition by account ID only.

C.Partition by account ID and region.

D.Partition by date and account ID.

AnswerD

Common queries filter by date range and account, so this minimizes scanned data.

Why this answer

Partitioning by date and account ID is most effective because the security team's queries will typically filter by time range and specific accounts. This minimizes data scanned by Athena, which charges per query based on the amount of data read. Partitioning by date first leverages natural time-based access patterns, while account ID further narrows scans when investigating incidents in specific accounts.

Exam trap

The trap here is that candidates often choose region-based partitioning (Option A or C) thinking it's important for geographic filtering, but in a multi-account logging scenario, account-level filtering is more frequent and cost-effective than region-level partitioning.

How to eliminate wrong answers

Option A is wrong because partitioning by region and date ignores the account ID, which is a primary filter for multi-account environments; queries for a specific account would still scan all regions' data for that date. Option B is wrong because partitioning by account ID only lacks a date partition, forcing Athena to scan all historical data for an account even when querying a specific time range. Option C is wrong because partitioning by account ID and region still misses the date partition, so queries filtered by time would scan all dates, increasing cost.

Practice this question →

136

Multi-Selectmedium

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Select 3 answers

A.Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.

B.Use a service control policy (SCP) to deny iam:CreateRole unless a specific tag (e.g., 'Approved') is present.

C.Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

D.Enable AWS CloudTrail to log all IAM role creation events.

E.Use AWS Config rules to detect roles without the 'Approved' tag and mark them as non-compliant.

AnswersA, B, E

Automates tagging after approval.

Why this answer

An AWS Lambda function triggered by CloudTrail events can automatically tag newly created IAM roles with an 'Approved' tag as part of an approval workflow. This ensures that only roles that have gone through the approval process receive the required tag, enabling downstream enforcement via SCPs or AWS Config.

Exam trap

The trap here is that candidates often confuse auditing (CloudTrail) with enforcement, or assume that deployment automation (CloudFormation StackSets) inherently includes approval workflows, when in fact neither provides the required preventive control.

Practice this question →

137

MCQmedium

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

A.Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

B.Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

C.Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.

D.Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

AnswerC

Automated solution reduces operational overhead.

Why this answer

The AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Exam trap

The trap here is that candidates often overestimate the simplicity of manual cross-account log delivery (Option A) or confuse AWS Glue's cataloging capabilities with log collection, while underestimating the operational overhead of building and maintaining such a solution from scratch versus using a purpose-built, managed solution like AWS Centralized Logging with OpenSearch Service.

How to eliminate wrong answers

Option A is wrong because while cross-account permissions can send logs to a central bucket, this approach requires manually configuring each account's log delivery (e.g., VPC Flow Logs, CloudTrail, DNS logs) and managing cross-account KMS key policies, which introduces significant operational overhead and does not provide a centralized, automated solution. Option B is wrong because creating separate S3 buckets for each log type and using AWS Glue to crawl and catalog logs adds unnecessary complexity and cost; Glue is for data cataloging and ETL, not for log collection or cross-account aggregation, and this approach does not address the requirement to capture logs from multiple accounts. Option D is wrong because S3 default encryption uses SSE-S3, not a customer-managed KMS key, and S3 Cross-Region Replication only replicates objects after they are stored, it does not capture logs from multiple accounts or handle the initial log delivery from various AWS services.

Practice this question →

138

MCQmedium

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

A.Use AWS Config conformance packs to deploy rules across accounts.

B.Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

C.Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.

D.Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

AnswerC

StackSets automatically deploy stacks to specified accounts and regions, including new accounts added to the organization.

Why this answer

AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Exam trap

The trap here is that candidates often confuse AWS Config conformance packs (which only handle Config rules) with the broader infrastructure deployment capability of CloudFormation StackSets, leading them to choose Option A even though it cannot deploy CloudTrail trails.

How to eliminate wrong answers

Option A is wrong because AWS Config conformance packs only deploy AWS Config rules and remediation actions, but they cannot deploy an AWS CloudTrail trail, which is a separate service requiring a stack or custom resource. Option B is wrong because using Lambda functions triggered by CloudTrail events to create stacks introduces additional complexity, latency, and potential failure points compared to the native StackSets automatic deployment feature; it also requires managing Lambda code, IAM roles, and event rules. Option D is wrong because AWS Service Catalog portfolios require users to manually launch products from the portfolio; they do not automatically deploy stacks to new accounts, so this would not meet the requirement for automatic enforcement.

Practice this question →

139

MCQmedium

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

A.Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.

B.Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

C.Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

D.Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

AnswerA

Correct: StackSets automate deployment across accounts; the resource creates the detector.

Why this answer

AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Exam trap

The trap here is that candidates often choose the Config + Lambda option (D) thinking it is fully automated, but they overlook that it is reactive and incurs ongoing evaluation costs, whereas StackSets provide a proactive, single-deployment solution with lower operational overhead.

How to eliminate wrong answers

Option B is wrong because AWS Service Catalog requires account owners to manually launch the product, which does not meet the requirement for automatic enabling and adds operational overhead. Option C is wrong because an SCP that denies delete and update actions does not enable GuardDuty; it only prevents modifications after manual enabling, which still requires manual action per account. Option D is wrong because AWS Config rules and Lambda functions are reactive (detect and remediate after the fact) and incur additional complexity and cost compared to a proactive, declarative StackSets deployment.

Practice this question →

140

MCQmedium

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

A.Enable AWS Cost Explorer and use default groupings

B.Create AWS Budgets for each department

C.Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags

D.Use the consolidated billing feature to view costs per account

AnswerC

Tags enable granular cost tracking by department.

Why this answer

Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Exam trap

The trap here is that candidates often confuse the account-level aggregation of consolidated billing (Option D) with the resource-level granularity needed for department tracking, or they assume AWS Budgets (Option B) provide visibility rather than just alerts.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer's default groupings (e.g., by service or linked account) do not provide department-level granularity unless custom tags or cost categories are used; relying on default groupings alone cannot break down costs by department. Option B is wrong because AWS Budgets are used to set spending thresholds and send alerts, not to provide granular visibility into historical or current cost breakdowns by department; they are a cost control mechanism, not a reporting or analysis tool. Option D is wrong because the consolidated billing feature aggregates costs at the account level, not at the department level; it cannot distinguish costs for resources within a single account that belong to different departments.

Practice this question →

141

Multi-Selectmedium

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Select 2 answers

A.Attach a bucket policy to each bucket that denies PutObject without encryption.

B.Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.

C.Create an IAM policy that denies s3:PutObject unless encryption is specified.

D.Enable S3 Block Public Access at the organization level.

E.Use AWS Config rules to detect S3 buckets without encryption and automatically apply encryption.

AnswersB, E

Prevents creation of unencrypted buckets.

Why this answer

A service control policy (SCP) can be applied at the organization, organizational unit (OU), or account level to deny the s3:CreateBucket action unless the request includes the x-amz-bucket-object-lock-enabled header or the bucket is created with default encryption enabled. This enforces encryption at rest for all new S3 buckets across the entire organization. Option E is correct because AWS Config rules can evaluate existing S3 buckets for encryption compliance and trigger an automatic remediation action, such as enabling default encryption via AWS Systems Manager Automation, ensuring both new and existing buckets are encrypted.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies or bucket policies, thinking they can enforce encryption on existing objects or buckets, when in fact SCPs only affect future API calls (like CreateBucket) and AWS Config is needed for ongoing compliance of existing resources.

Practice this question →

142

Multi-Selectmedium

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Select 2 answers

A.Use AWS CloudFormation StackSets to deploy GuardDuty in each account

B.Enable GuardDuty manually in each member account by logging into each account

C.Create a service control policy to force GuardDuty to be enabled

D.Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization

E.Designate a member account as the GuardDuty delegated administrator

AnswersD, E

Delegated administrator can enable GuardDuty across all accounts via API.

Why this answer

AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Exam trap

The trap here is that candidates often confuse service control policies (SCPs) with proactive enforcement, but SCPs only restrict permissions and cannot automatically enable a service; they also overlook that CloudFormation StackSets cannot enable a service like GuardDuty, which requires a specific API action rather than resource deployment.

Practice this question →

143

MCQmedium

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

A.Create an IAM policy in each account that requires the CostCenter tag.

B.Use AWS Config rules to identify untagged resources and automatically tag them.

C.Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.

D.Use an SCP to deny resource creation if the CostCenter tag is missing.

AnswerC

Tag policies centrally enforce tagging rules across all accounts.

Why this answer

AWS Organizations tag policies allow you to define rules for tagging resources across all accounts in the organization, including enforcement of required tags like 'CostCenter'. Tag policies are evaluated at resource creation and can prevent non-compliant resources from being created, ensuring consistent cost allocation tagging without requiring individual account-level IAM changes.

Exam trap

The trap here is confusing SCPs with tag policies; candidates often think SCPs can enforce tag requirements on resource creation, but SCPs only deny actions based on existing tags, not enforce tag presence at creation time, whereas tag policies provide native enforcement for tag-on-create APIs.

How to eliminate wrong answers

Option A is wrong because IAM policies control permissions for users and roles, not resource creation; they cannot enforce tags on resources created by other services or by users with different permissions. Option B is wrong because AWS Config rules can detect untagged resources but cannot automatically tag them; they only trigger evaluations and can invoke remediation actions via Systems Manager Automation, but the question asks for enforcement, not detection. Option D is wrong because SCPs can deny actions based on conditions like missing tags, but they cannot require a tag on resource creation; SCPs are permission boundaries that deny API calls, but they cannot enforce tag presence at the moment of resource creation because the tag condition is evaluated after the resource exists, leading to a potential race condition.

Practice this question →

144

MCQhard

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

A.The SCP is not applied to the root user of the member account.

B.The SCP cannot restrict actions based on region.

C.The SCP policy document does not contain a Deny statement for the regions.

D.The SCP is overridden by an Allow policy attached to the account.

AnswerC

The exhibit only shows the policy metadata, not the content.

Why this answer

The SCP policy document must explicitly include a Deny statement with a condition that restricts actions to only us-east-1 and eu-west-1. Without a Deny statement, the SCP is effectively permissive (Allow) by default, meaning it does not block actions in other regions. The SCP in the exhibit likely only has Allow statements for the two allowed regions, which does not prevent actions in ap-southeast-1.

Exam trap

The trap here is that candidates assume SCPs work like IAM policies where an explicit Allow is required, but SCPs require an explicit Deny to block actions; otherwise, they are permissive by default.

How to eliminate wrong answers

Option A is wrong because SCPs apply to all IAM users and roles in the account, including the root user, unless explicitly excluded; the root user is not exempt from SCPs. Option B is wrong because SCPs can restrict actions based on region using the 'aws:RequestedRegion' condition key in a Deny statement, so the statement that SCPs cannot restrict actions by region is false. Option D is wrong because SCPs are not overridden by Allow policies; SCPs set the maximum permissions boundary, and an Allow policy attached to an account cannot grant permissions that an SCP denies.

Practice this question →

145

Multi-Selectmedium

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Select 2 answers

A.Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.

B.Use AWS Service Catalog to enforce tagging on EC2 products.

C.Use AWS Resource Access Manager to share a tagging policy across accounts.

D.Apply a service control policy (SCP) that denies ec2:RunInstances if the required tags are not specified.

E.Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

AnswersA, D

Config rules can enforce tagging compliance.

Why this answer

AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Exam trap

The trap here is that candidates often confuse AWS Service Catalog's tagging enforcement as a global solution, not realizing it only applies to products launched through the catalog, not to direct EC2 API calls across accounts.

Practice this question →

146

Matchingmedium

Match each AWS disaster recovery strategy to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Lowest cost, RPO in hours, RTO in hours to days

Core services run in standby, ready to scale

Scaled-down production environment, ready to scale up

Both sites serve traffic, failover is immediate

One site active, other on standby

Why these pairings

AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Practice this question →

147

Multi-Selecthard

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Select 3 answers

A.AWS Organizations

B.AWS Config

C.AWS IAM Access Analyzer

D.AWS CloudTrail

E.Amazon GuardDuty

AnswersA, C, D

Organizations provides a central view and management of all accounts.

Why this answer

AWS Organizations is correct because it provides a centralized governance framework for managing multiple AWS accounts, enabling the security team to apply service control policies (SCPs) that centrally restrict IAM permissions across all member accounts. This allows the security account to enforce permission boundaries and audit IAM actions at the organizational level.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation with IAM permission management, but Config does not enforce or audit IAM permissions across accounts—it only checks resource configurations against rules.

Practice this question →

148

MCQmedium

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

A.Use AWS Config rules to detect missing flow logs and send alerts to the security team.

B.Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.

C.Use an SCP to require that VPC flow logs be enabled.

D.Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

AnswerB

StackSets automate deployment across accounts and regions.

Why this answer

AWS CloudFormation StackSets can deploy a VPC flow log configuration across multiple accounts and regions in an AWS Organization, and the central S3 bucket policy must allow cross-account delivery from all accounts. This approach automates the deployment for new accounts as they are added to the organization, meeting the requirement for centralized management and automation.

Exam trap

The trap here is that candidates may think SCPs can enforce resource configurations like enabling flow logs, but SCPs only control permissions and cannot create or configure resources; they must be combined with automation tools like StackSets or AWS Config rules with auto-remediation.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect missing flow logs and send alerts, but they do not automatically enable flow logs or deliver them to a central S3 bucket; they only provide compliance monitoring and notifications. Option C is wrong because Service Control Policies (SCPs) can restrict actions but cannot directly enable VPC flow logs or configure their delivery to a central S3 bucket; SCPs are for permission boundaries, not resource configuration. Option D is wrong because manually enabling flow logs in each account and region is not automated and does not scale for new accounts added to the organization, violating the automation requirement.

Practice this question →

149

Multi-Selectmedium

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Select 3 answers

A.AWS Glue

B.S3 Object Lock

C.AWS CloudTrail

D.Amazon S3

E.Amazon Kinesis Data Streams

AnswersB, C, D

Prevents deletion or overwriting of logs.

Why this answer

S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Exam trap

The trap here is that candidates may confuse Kinesis Data Streams as a storage service for logs, but it is a streaming ingestion layer with no built-in immutability or long-term retention, while Glue is mistakenly chosen for its data cataloging capabilities rather than for log storage.

Practice this question →

150

MCQmedium

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

A.Enable CloudTrail log file validation and use IAM policies to limit access.

B.Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.

C.Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

D.Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

AnswerB

SCP enforces encryption, and bucket policy restricts access to the required role.

Why this answer

Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Exam trap

The trap here is that candidates often confuse enabling default encryption (which only applies to new objects if no encryption header is provided) with enforcing encryption via policy, or they overlook that SCPs can enforce encryption requirements across all accounts in an organization, not just within a single account.

How to eliminate wrong answers

Option A is wrong because CloudTrail log file validation only provides integrity verification (detecting if logs were modified), not encryption at rest or access control; IAM policies alone cannot enforce encryption requirements. Option C is wrong because SSE-S3 provides encryption at rest but does not allow the security team to control key management or enforce encryption via policy; a bucket policy alone cannot prevent unauthorized access if IAM roles are not properly scoped. Option D is wrong because while using a customer managed key with KMS is good, attaching an SCP to prevent key deletion does not enforce encryption on S3 put operations or restrict access to the bucket; it only protects the key from deletion, not the logs themselves.

Practice this question →