CCNA Org Complexity Questions — Page 4 of 6

226

MCQhard

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

A.Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket

B.Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts

C.Create VPC endpoints in each account to connect to the central S3 bucket

D.Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group

AnswerB

VPC Flow Logs support cross-account delivery to S3 with appropriate bucket policy.

Why this answer

VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Exam trap

The trap here is that candidates assume cross-account S3 delivery requires a VPC endpoint or a streaming service like Firehose, but AWS natively supports direct cross-account S3 delivery for VPC Flow Logs via bucket policies.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose adds unnecessary complexity and cost; VPC Flow Logs can natively deliver to S3 without requiring Firehose. Option C is wrong because VPC endpoints provide private connectivity to S3 but do not enable cross-account log delivery; the bucket policy is the mechanism for cross-account access. Option D is wrong because publishing to a central CloudWatch Logs group does not place logs in the central S3 bucket as required, and CloudWatch Logs is not the target specified in the question.

Practice this question →

227

MCQmedium

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

A.Create an IAM role in the member account with permissions to manage Identity Center

B.Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center

C.Attach an SCP to the member account allowing Identity Center actions

D.Create a new user in the management account with admin privileges

AnswerB

This grants the member account admin rights over Identity Center.

Why this answer

To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Exam trap

The trap here is that candidates often confuse delegating administration with simply granting IAM permissions via roles or SCPs, not realizing that AWS requires a specific registration process through Organizations to enable delegated administration for Identity Center.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in the member account with permissions to manage Identity Center does not establish the required delegation relationship; Identity Center delegation must be registered at the Organizations level, not via a local IAM role. Option C is wrong because attaching a service control policy (SCP) to the member account only restricts or allows actions at the account level but does not delegate administrative authority for Identity Center; SCPs are for permission boundaries, not delegation. Option D is wrong because creating a new user in the management account with admin privileges does not delegate administration to a member account; it keeps all control in the management account and does not enable the member account to manage Identity Center independently.

Practice this question →

228

MCQhard

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

A.A policy that denies all IAM and organization actions except for viewing.

B.A policy that allows all IAM actions and denies organizations:CreateAccount and organizations:UpdateOrganizationalUnit.

C.A policy that allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization.

D.A policy that allows iam:* and denies organizations:CreateAccount, organizations:CreateOrganizationalUnit, organizations:UpdateOrganizationalUnit, and organizations:DeleteOrganizationalUnit.

AnswerD

This allows IAM management while denying organization structure changes.

Why this answer

It grants the OU administrators full IAM permissions (iam:*) to manage roles and policies within their own OUs, while explicitly denying the specific Organizations API actions that could alter the OU structure (CreateOrganizationalUnit, UpdateOrganizationalUnit, DeleteOrganizationalUnit) or create new accounts (CreateAccount). This policy ensures administrators can perform their required tasks without being able to modify the organizational hierarchy or provision new accounts, aligning with the principle of least privilege.

Exam trap

The trap here is that candidates often confuse IAM policies with Service Control Policies (SCPs) or forget to deny all relevant OU-modifying actions (CreateOrganizationalUnit, UpdateOrganizationalUnit, DeleteOrganizationalUnit) in addition to CreateAccount, leading them to choose an incomplete policy like Option B.

How to eliminate wrong answers

Option A is wrong because denying all IAM and organization actions except for viewing would prevent OU administrators from managing IAM roles and policies, which is the core requirement. Option B is wrong because it allows all IAM actions but only denies CreateAccount and UpdateOrganizationalUnit; it does not deny CreateOrganizationalUnit or DeleteOrganizationalUnit, leaving the OU structure vulnerable to modification. Option C is wrong because it allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization, which is overly permissive—it permits creating new accounts and modifying OUs, violating the requirement to prevent such changes.

Practice this question →

229

Multi-Selectmedium

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Select 2 answers

A.Create a PrivateLink endpoint for IPAM.

B.Enable VPC sharing in each member account.

C.Share the IPAM pool using AWS Resource Access Manager (RAM).

D.Set up AWS Direct Connect between accounts.

E.Delegate an administrator account for IPAM.

AnswersC, E

RAM enables sharing IPAM pools across accounts.

Why this answer

AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Exam trap

The trap here is that candidates confuse IPAM pool sharing (which uses RAM) with VPC sharing or network connectivity services like Direct Connect, leading them to select irrelevant options that address different aspects of multi-account networking.

Practice this question →

230

MCQhard

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

A.Use AWS Config rules to detect non-compliant roles and send alerts.

B.Deploy the IAM roles using AWS CloudFormation StackSets.

C.Request each business unit to create the required IAM roles manually.

D.Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.

AnswerD

SCPs can enforce conditions on role creation centrally.

Why this answer

An SCP (Service Control Policy) that denies `iam:CreateRole` unless the role has the required trust policy is the most scalable enforcement mechanism. SCPs are applied at the organizational unit (OU) or account level in AWS Organizations, allowing the central security team to centrally prevent the creation of non-compliant IAM roles across all business unit accounts without requiring per-account configuration or manual intervention. This approach enforces compliance proactively (preventive control) rather than reactively (detective control), and it scales automatically as new accounts are added to the organization.

Exam trap

The trap here is that candidates often choose AWS Config (Option A) because it is a common compliance tool, but they fail to recognize that Config is detective, not preventive, and the question specifically asks for 'enforce,' which requires a preventive control like an SCP.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective controls that only detect and alert on non-compliant roles after they are created; they do not prevent the creation of non-compliant roles, so they are not an enforcement mechanism and require additional remediation automation to be effective. Option B is wrong because CloudFormation StackSets can deploy IAM roles consistently, but they cannot prevent business units from manually creating or modifying roles outside of the StackSet deployment, leaving the environment vulnerable to non-compliant roles. Option C is wrong because relying on manual creation by each business unit is not scalable, introduces human error, and provides no centralized enforcement or audit trail, making it impossible for the central security team to guarantee compliance across all accounts.

Practice this question →

231

MCQeasy

A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?

A.A role in the dev account with permissions to access production resources.

B.An IAM user in the production account with permissions to switch roles.

C.A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.

D.An SCP that allows sts:AssumeRole from the dev account.

AnswerC

This is the standard cross-account role access setup.

Why this answer

Cross-account IAM role access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal, and an IAM policy in the source account that grants the sts:AssumeRole action for that role's ARN. This two-part configuration establishes a secure delegation path where the dev account's users or roles can request temporary credentials from the production account via the AWS Security Token Service (STS).

Exam trap

The trap here is that candidates often confuse the direction of the trust relationship, mistakenly thinking the role must be in the source account (dev) rather than the target account (production), or they overlook that both a trust policy and an IAM permissions policy are required for cross-account access.

How to eliminate wrong answers

Option A is wrong because a role in the dev account cannot directly access production resources; cross-account access requires the role to be in the production account, not the dev account. Option B is wrong because an IAM user in the production account with permissions to switch roles would only allow that user to assume roles within the same account, not from an external dev account; cross-account access requires a trust policy on the production role that authorizes the dev account. Option D is wrong because an SCP (Service Control Policy) is an organization-level policy that can restrict actions but cannot grant permissions; it can only deny or allow actions at the account level, and it does not establish the trust relationship needed for cross-account role assumption.

Practice this question →

232

MCQhard

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

A.Use S3 bucket policies with aws:SourceIp condition.

B.Use AWS Config rules to detect and alert on non-compliant access.

C.Use network ACLs in each VPC.

D.Use service control policies with aws:SourceIp and aws:SourceVpc conditions.

AnswerD

SCPs can deny access from unapproved networks across all services.

Why this answer

Service control policies (SCPs) in AWS Organizations can enforce a data perimeter by restricting access based on network origin using the `aws:SourceIp` and `aws:SourceVpc` condition keys. This approach works across all accounts in the organization, ensuring that only requests from approved networks (e.g., specific IP ranges or VPCs) are allowed, regardless of individual account configurations.

Exam trap

The trap here is that candidates often confuse resource-level policies (like S3 bucket policies) with organization-wide controls (SCPs), or they mistake detective controls (AWS Config) for preventive controls, leading them to choose options that only partially address the requirement or are reactive rather than proactive.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies with `aws:SourceIp` only apply to S3 resources and cannot enforce a data perimeter across all accounts or services; they are resource-specific, not organization-wide. Option B is wrong because AWS Config rules are detective controls that alert on non-compliant access after it occurs, not preventive controls that block unauthorized access. Option C is wrong because network ACLs operate at the subnet level within a single VPC and cannot enforce policies across multiple accounts or control access to services outside the VPC (e.g., S3 via public endpoints).

Practice this question →

233

MCQhard

A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?

A.Use AWS Config rules to detect and remediate any changes to CloudTrail configurations.

B.Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.

C.Create an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all IAM users.

D.Apply a resource-based policy to the CloudTrail trail that denies these actions.

AnswerB

Correct. A service control policy (SCP) can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions across all accounts in the organization, providing a preventive control that applies to all principals including the root user.

Why this answer

Service control policies (SCPs) are the only preventive control that can centrally deny actions across all accounts in an AWS Organization. SCPs affect all users and roles, including the root user, and can block the ability to stop CloudTrail logging or delete trails. Option A (AWS Config rules) is detective and can trigger remediation, but it is not preventive; remediation can fail or be bypassed.

Option C (IAM policy) only applies within an account and does not prevent actions by the root user or external roles. Option D (resource-based policy) cannot be applied to CloudTrail trails to deny actions; CloudTrail supports resource-based policies for delivery notifications (SNS) but not to control trail management actions.

Practice this question →

234

Multi-Selectmedium

A company is planning to migrate its on-premises workload to AWS. The workload consists of a stateful web application that requires a static IP address for whitelisting by third-party services. The company will use a multi-AZ deployment. Which service should be used to meet these requirements?

Select 1 answer

A.Amazon Route 53

B.Amazon CloudFront

C.Network Load Balancer (NLB)

D.Application Load Balancer (ALB)

E.AWS Global Accelerator

AnswersC

Correct. Network Load Balancer (NLB) provides static IP addresses per Availability Zone, which can be whitelisted by third-party services, and supports multi-AZ deployments.

Why this answer

For a stateful web application requiring static IP addresses for third-party whitelisting in a multi-AZ deployment, only a Network Load Balancer (NLB) provides static IPs per Availability Zone. Application Load Balancer (ALB) uses a DNS name with changing IPs and does not offer static IPs. Therefore, NLB alone meets the requirement; ALB is not needed for static IP whitelisting.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's static IPs with NLB's static IPs, but Global Accelerator is optimized for global traffic and adds unnecessary complexity and cost for a single-region multi-AZ deployment where per-AZ static IPs are sufficient for whitelisting.

Practice this question →

235

MCQeasy

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

A.Use AWS Systems Manager Patch Manager in the management account.

B.Use AWS Systems Manager Quick Setup to configure patching across accounts.

C.Use AWS Systems Manager Automation documents in each account.

D.Use AWS Config rules to trigger patching in each account.

AnswerB

Quick Setup provides centralized configuration across accounts in an organization.

Why this answer

AWS Systems Manager Quick Setup is the most efficient way to centrally configure patching across multiple AWS accounts because it automates the deployment of SSM Patch Manager resources, including patch baselines, maintenance windows, and IAM roles, across accounts in an AWS Organization. It eliminates the need to manually set up patching in each account, providing a single-pane-of-glass management experience from the management account.

Exam trap

The trap here is that candidates often assume Patch Manager in the management account is sufficient for cross-account patching, overlooking the need for centralized orchestration across accounts, which Quick Setup provides.

How to eliminate wrong answers

Option A is wrong because using Patch Manager in the management account alone does not automatically extend patching to other accounts; it only manages instances in the management account unless cross-account roles and manual configurations are set up, which is less efficient than Quick Setup. Option C is wrong because using Automation documents in each account requires manual deployment and maintenance of automation runbooks per account, lacking centralized orchestration and scaling capabilities. Option D is wrong because AWS Config rules can detect non-compliant patches but cannot directly trigger patching actions; they would need to invoke a remediation action via Systems Manager Automation, which adds complexity and is not a direct patching solution.

Practice this question →

236

MCQmedium

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

A.Apply an SCP to the development account that denies iam:CreateUser.

B.Create an IAM group for developers with a policy that denies iam:CreateUser.

C.Enable AWS CloudTrail to monitor iam:CreateUser calls.

D.Attach an IAM policy to each developer user that denies iam:CreateUser.

AnswerA

SCPs are effective even for users with full administrative permissions.

Why this answer

Service Control Policies (SCPs) are the most effective way to enforce permissions boundaries across entire accounts in AWS Organizations. An SCP applied to the development account will deny the `iam:CreateUser` action for all principals (including the root user) in that account, regardless of any IAM policies attached to users or roles. This ensures developers cannot create IAM users, even if they have full administrative access within the account.

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-specific and can be overridden) with SCPs (which are organization-wide and cannot be bypassed by account administrators), leading them to choose an IAM-based solution that is less effective for cross-account control.

How to eliminate wrong answers

Option B is wrong because an IAM group policy only applies to users who are members of that group; developers could be added to other groups or have inline policies that grant `iam:CreateUser`, bypassing the restriction. Option C is wrong because AWS CloudTrail only logs API calls for auditing purposes and does not prevent the `iam:CreateUser` action from being executed. Option D is wrong because an IAM policy attached to each developer user is not scalable and can be overridden by other policies (e.g., a full-admin policy) that grant the same action; it also does not prevent a developer from creating a new user with a different set of permissions.

Practice this question →

237

Multi-Selecthard

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Select 2 answers

A.Enable CloudTrail organization trail from the management account.

B.Create an AWS Lambda function in each account to enable CloudTrail.

C.Attach an SCP that requires CloudTrail to be enabled.

D.Create an AWS Config rule to detect accounts without CloudTrail.

E.Use AWS CloudFormation StackSets with service-managed permissions to deploy a CloudTrail trail to all accounts.

AnswersA, E

Organization trails automatically apply to all accounts.

Why this answer

Enabling an organization trail from the management account automatically creates a CloudTrail trail for all accounts in the AWS Organization, including future accounts, without requiring per-account configuration. This ensures centralized logging to a single S3 bucket and enforces compliance across the entire organization.

Exam trap

The trap here is confusing detective controls (like AWS Config rules) with preventive or automated enforcement mechanisms, leading candidates to choose Option D instead of recognizing that organization trails provide native, automatic compliance.

Practice this question →

238

MCQhard

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

A.Use AWS CloudFormation templates manually triggered in each account.

B.Create a VPC in one account and share it with other accounts using AWS Resource Access Manager (RAM).

C.Use AWS Control Tower account factory and AWS CloudFormation StackSets to deploy the VPC across all accounts.

D.Use AWS Organizations to create the VPC in each account via an SCP.

AnswerC

Control Tower account factory with StackSets automates deployment of identical resources across accounts.

Why this answer

AWS Control Tower's Account Factory combined with AWS CloudFormation StackSets enables automated, centralized deployment of identical VPC configurations across all 50 accounts in the same Region. StackSets allow you to deploy a CloudFormation template to multiple accounts and Regions from a single administrator account, ensuring consistency without manual intervention.

Exam trap

The trap here is confusing AWS Resource Access Manager (RAM) for creating separate VPCs in each account versus sharing a single VPC, and misunderstanding that SCPs only control permissions, not resource creation.

How to eliminate wrong answers

Option A is wrong because manually triggering CloudFormation templates in each account is inefficient, error-prone, and does not scale to 50 accounts, violating the 'most efficient' requirement. Option B is wrong because sharing a VPC via AWS Resource Access Manager (RAM) does not create a separate VPC in each account; it shares a single VPC, which does not meet the requirement of deploying a VPC in each account. Option D is wrong because AWS Organizations Service Control Policies (SCPs) are used to restrict permissions, not to create resources like VPCs; SCPs cannot deploy infrastructure.

Practice this question →

239

MCQmedium

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

A.The users are using SSE-S3 encryption (AES256).

B.The SCP is missing a Deny for s3:PutObject without any encryption header.

C.The users are using SSE-C encryption.

D.The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.

AnswerD

The SCP only denies s3:PutObject, not s3:UploadPart.

Why this answer

The SCP likely denies s3:PutObject unless encryption headers are present, but the Multipart Upload API uses the s3:UploadPart action for uploading individual parts. Since the SCP only denies s3:PutObject without encryption, the s3:UploadPart action is not covered, allowing unencrypted uploads via multipart uploads. This is why users can still upload objects without encryption despite the SCP.

Exam trap

The trap here is that candidates assume denying s3:PutObject without encryption covers all uploads, but they overlook that multipart uploads use the s3:UploadPart action, which is not affected by the s3:PutObject Deny.

How to eliminate wrong answers

Option A is wrong because SSE-S3 encryption (AES256) is a form of server-side encryption that would satisfy an encryption requirement; the SCP is intended to block unencrypted uploads, so using SSE-S3 would actually be compliant, not a reason for bypassing the policy. Option B is wrong because the SCP may already include a Deny for s3:PutObject without encryption headers; the issue is that the SCP does not cover the s3:UploadPart action used in multipart uploads. Option C is wrong because SSE-C encryption (customer-provided keys) also provides encryption and would satisfy an encryption requirement, so it would not allow unencrypted uploads; the problem is the action mismatch, not the encryption type.

Practice this question →

240

MCQmedium

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

A.Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.

B.Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

C.Use the root user of each account to access the buckets.

D.Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

AnswerA

This provides scalable and secure cross-account access.

Why this answer

It uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Exam trap

The trap here is that candidates may choose Option B thinking bucket policies are simpler, but they overlook the scalability and maintenance burden of managing individual bucket policies across hundreds or thousands of buckets, and the fact that bucket policies do not support cross-account access without explicitly listing the principal ARN, which is less flexible than IAM roles.

How to eliminate wrong answers

Option B is wrong because attaching bucket policies to each S3 bucket individually is not scalable for large environments and requires managing policies per bucket, which can lead to policy size limits and complexity. Option C is wrong because using root users violates the principle of least privilege, is not auditable, and is insecure due to shared static credentials. Option D is wrong because creating IAM users in each account with shared credentials introduces long-term access keys that must be rotated and managed, increasing security risk and operational overhead compared to role-based access.

Practice this question →

241

Multi-Selectmedium

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

Select 2 answers

A.Enable default encryption with SSE-S3 or SSE-KMS.

B.Block all public access using the S3 Block Public Access feature.

C.Enable S3 Transfer Acceleration.

D.Configure a lifecycle policy to transition objects to Glacier.

E.Enable S3 Select to filter data.

AnswersA, B

Encrypts objects at rest.

Why this answer

Enabling default encryption with SSE-S3 or SSE-KMS ensures that all objects written to the S3 bucket are automatically encrypted at rest, protecting sensitive data even if the uploader does not explicitly request encryption. This is a foundational security control that mitigates the risk of data exposure due to misconfigured uploads or accidental storage of unencrypted data.

Exam trap

The trap here is that candidates may confuse performance or cost features (Transfer Acceleration, Glacier lifecycle, S3 Select) with security controls, leading them to select options that do not actually protect data confidentiality or integrity.

Practice this question →

242

MCQhard

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

A.Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

B.Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.

C.Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

D.Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

AnswerB

Multi-Region replication provides automatic failover and low-latency authentication in each Region.

Why this answer

AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Exam trap

The trap here is that candidates often confuse VPC peering or VPN connectivity as sufficient for high availability, overlooking that a single-Region directory is a single point of failure and that multi-Region replication is the only option that provides automatic failover and operational efficiency across Regions.

How to eliminate wrong answers

Option A is wrong because AD Connector is a proxy that forwards authentication requests to an on-premises Active Directory, not a managed directory in AWS, and it does not provide a highly available, multi-Region directory for the migration scenario. Option C is wrong because VPC peering does not provide automatic failover or high availability for the directory; it only enables network connectivity, and the single-Region directory would be a single point of failure. Option D is wrong because VPN connections add network complexity and latency, and a single-Region directory lacks automatic failover across Regions, making it less operationally efficient than multi-Region replication.

Practice this question →

243

MCQmedium

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

A.Use AWS Cost Explorer to view costs by linked account.

B.Define cost allocation tags for each department and enable them in the Billing and Cost Management console.

C.Set up AWS Budgets for each department with alerts.

D.Create AWS Resource Groups for each department and use AWS Config to track costs.

AnswerB

Tags allow grouping and tracking costs by department across accounts.

Why this answer

Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Finance') and then activate those tags in the Billing and Cost Management console. Once enabled, AWS Cost Explorer and cost reports can filter and group costs by these tags, providing accurate per-department cost tracking across multiple accounts in AWS Organizations. This is the most precise method because it directly associates resource usage with the department responsible, regardless of which account hosts the resource.

Exam trap

The trap here is that candidates often confuse account-level grouping (Option A) with tag-based allocation, assuming that each department has its own AWS account, but the question explicitly states departments use resources across several accounts, making tag-based allocation the only accurate method.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer viewing costs by linked account only shows costs per AWS account, not per department; a single department may span multiple accounts, and a single account may host resources for multiple departments, so account-level grouping cannot accurately allocate costs to departments. Option C is wrong because AWS Budgets are used for setting cost thresholds and sending alerts, not for allocating or tracking historical costs by department; they do not provide a mechanism to assign costs to departments. Option D is wrong because AWS Resource Groups are logical groupings of resources based on tags or other criteria, and AWS Config tracks resource configuration changes and compliance, not cost allocation; neither service provides cost tracking or allocation capabilities.

Practice this question →

244

MCQeasy

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

A.AWS CloudEndure Disaster Recovery

B.Amazon S3 Glacier

C.AWS Storage Gateway

D.AWS Backup

AnswerD

Centralized backup service with cross-account support.

Why this answer

AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that integrates with AWS Organizations to centrally manage backups across multiple accounts. It allows you to define backup policies that automatically apply to EC2 instances and other supported resources across all member accounts, ensuring compliance and centralized monitoring without requiring per-account manual configuration.

Exam trap

The trap here is that candidates may confuse AWS Backup with disaster recovery services like CloudEndure, not realizing that AWS Backup is purpose-built for centralized, policy-driven backup management across multiple accounts, while CloudEndure focuses on continuous replication for failover, not scheduled backups.

How to eliminate wrong answers

Option A is wrong because AWS CloudEndure Disaster Recovery is designed for continuous replication and rapid failover for disaster recovery scenarios, not for scheduled, policy-based backup management across multiple accounts. Option B is wrong because Amazon S3 Glacier is a storage class for long-term archival of objects, not a service for orchestrating or managing backups of EC2 instances across accounts. Option C is wrong because AWS Storage Gateway provides hybrid cloud storage access (e.g., file, volume, tape gateways) for on-premises environments, not centralized backup management of EC2 instances within AWS Organizations.

Practice this question →

245

Multi-Selecthard

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Select 2 answers

A.Amazon Cognito

B.AWS Direct Connect

C.AD Connector

D.AWS Single Sign-On (SSO)

E.AWS Managed Microsoft AD

AnswersC, E

AD Connector connects AWS services to on-premises AD, enabling SSO and authentication.

Why this answer

AD Connector (Option C) is correct because it acts as a proxy to redirect authentication requests from AWS services to your on-premises Active Directory without caching credentials or requiring directory synchronization, enabling seamless SSO for users. AWS Managed Microsoft AD (Option E) is correct because it provides a highly available, fully managed Active Directory in the AWS cloud that can be extended to multiple regions via trust relationships, supporting low-latency authentication for thousands of users across regions.

Exam trap

The trap here is that candidates often confuse AWS Single Sign-On (SSO) as a standalone identity provider, but it requires an underlying directory service (like AWS Managed Microsoft AD or AD Connector) to authenticate against on-premises Active Directory, making it an incomplete solution on its own.

Practice this question →

246

MCQhard

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only t3.micro, t3.small, m5.large, and m5.xlarge instances. Which SCP should be applied?

A.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

B.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.micro","t3.small","m5.large","m5.xlarge"]}}}

C.{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

D.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}

AnswerB

Correct. Deny with StringNotEquals using specific instance types and instance resource ARN.

Why this answer

The correct SCP because it targets the instance resource with a resource ARN and uses a Deny effect with StringNotEquals to block any instance types not in the allowed list. By listing the specific instance types explicitly, the policy avoids the unsupported use of wildcards in StringNotEquals conditions for ec2:InstanceType. This ensures that only the specified instance types can be launched.

Exam trap

Candidates might choose Option A because it uses a similar deny condition but with a broader resource '*' and wildcards. However, the resource must be specific to the instance for the condition to be evaluated, and wildcards are not supported in StringNotEquals, making Option A ineffective.

How to eliminate wrong answers

Option B is wrong because it restricts the Resource to 'arn:aws:ec2:*:*:instance/*', which only covers existing instance resources, not the RunInstances action itself; SCPs with Deny on RunInstances must use Resource '*' to block the launch action, otherwise the policy may not prevent the creation of new instances. Option C is wrong because it uses an Allow effect, which is ineffective in SCPs since SCPs are deny lists by default; an Allow SCP does not grant permissions—it only sets a maximum permission boundary, and without a corresponding Deny for non-allowed types, all instance types remain permitted. Option D is wrong because it denies all EC2 RunInstances actions without any condition, which would block all instance types entirely, not just restrict to T3 and M5.

Practice this question →

247

MCQeasy

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

A.Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

B.Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

C.Use an SCP to require CloudTrail to be enabled in each account.

D.Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.

AnswerD

Control Tower automatically sets up a CloudTrail trail in the management account that logs all accounts.

Why this answer

AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Exam trap

The trap here is that candidates often assume SCPs can enforce service enablement (like enabling CloudTrail), but SCPs only control permissions—they cannot enable services or resources; they can only prevent disabling of existing configurations.

How to eliminate wrong answers

Option A is wrong because using a periodic Lambda function is reactive, introduces latency, and does not prevent accounts from disabling CloudTrail between runs; it also adds operational overhead and potential single points of failure. Option B is wrong because an AWS Config rule can only detect non-compliance and trigger remediation (e.g., via auto-remediation), but it cannot enforce the setting across all accounts proactively; it also requires Config to be enabled in each account first. Option C is wrong because SCPs can only deny or allow API actions, not enable services; an SCP cannot force CloudTrail to be enabled—it can only prevent disabling of an already-enabled trail or block certain CloudTrail API calls.

Practice this question →

248

Multi-Selecthard

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Select 3 answers

A.Create a StackSet with the template and target the OU, enabling automatic deployment.

B.Create an AWS CloudFormation template that defines the common resources.

C.Use AWS Config rules to detect missing resources and deploy them via Lambda.

D.Enable AWS CloudFormation StackSets trusted access with AWS Organizations.

E.Create an SCP that requires the creation of those resources.

AnswersA, B, D

Automatically deploys to new accounts in the OU.

Why this answer

AWS CloudFormation StackSets allow you to deploy a common CloudFormation template across multiple accounts and regions. By targeting an organizational unit (OU) and enabling automatic deployment, any new account added to that OU will automatically receive the defined resources, fulfilling the automation requirement.

Exam trap

The trap here is confusing AWS Config (a detective control) with a provisioning tool, and assuming SCPs can create resources when they only enforce permission boundaries.

Practice this question →

249

MCQhard

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

A.Use S3 access points in each account to grant access to the central bucket.

B.Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.

C.Create an S3 interface endpoint in the logging account and share it with other accounts.

D.Copy logs to each account's own S3 bucket and run Athena queries locally.

AnswerB

Lake Formation provides fine-grained access control and can be used with Athena for cross-account queries without copying data.

Why this answer

AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Exam trap

The trap here is that candidates often assume S3 access points or interface endpoints are sufficient for cross-account Athena queries, but they overlook that Athena requires a centralized metadata catalog and fine-grained permissions that only Lake Formation (or a combination of Glue Catalog and IAM) can provide cost-effectively.

How to eliminate wrong answers

Option A is wrong because S3 access points are primarily for managing access to a single bucket from within the same account or via VPC origins, not for granting cross-account Athena query access; they do not natively integrate with Athena’s cross-account query capabilities and would require additional IAM policies and bucket policies, increasing complexity and cost. Option C is wrong because an S3 interface endpoint (AWS PrivateLink) only provides private network connectivity to S3, not cross-account data access or permission management; it does not enable Athena to query data across accounts without additional IAM roles and bucket policies, and it incurs hourly endpoint charges. Option D is wrong because copying logs to each account’s own S3 bucket duplicates storage costs, increases data transfer fees, and introduces latency, making it far less cost-effective than a centralized approach with Lake Formation.

Practice this question →

250

MCQhard

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

A.The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

B.The S3 bucket policy denies access to the workload accounts.

C.The S3 bucket has a bucket policy that requires encryption in transit.

D.The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.

AnswerD

Key policy must allow the service principal from workload accounts.

Why this answer

Even though the IAM role in the workload account has permissions to write to the S3 bucket, the KMS key policy in the logging account must explicitly grant the VPC Flow Logs service principal permission to use the key for encryption. Without this key policy statement, the logs cannot be encrypted and delivered. Option A is incorrect because VPC Flow Logs can be delivered directly to S3 without CloudWatch Logs.

Option B is incorrect because a bucket policy denying workload accounts would be an issue, but the question states the IAM role has necessary permissions, and the key policy is the missing piece. Option C is incorrect because encryption in transit is not a common requirement for VPC Flow Logs delivery to S3, and the issue is about encryption at rest using KMS.

Practice this question →

251

MCQeasy

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

A.Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity

B.Apply a service control policy to allow cross-account access

C.Create an IAM user in the production account and share the credentials with the development team

D.Configure security group rules to allow access from the development account

AnswerA

This allows users from the development account to assume the role and gain permissions.

Why this answer

Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Exam trap

The trap here is that candidates confuse network-level controls (security groups) or organizational policies (SCPs) with IAM-based cross-account trust, or mistakenly think sharing IAM user credentials is acceptable for cross-account access.

How to eliminate wrong answers

Option B is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an AWS Organization; they do not grant cross-account access themselves and cannot be used to allow role assumption between accounts. Option C is wrong because sharing IAM user credentials violates the principle of least privilege and security best practices; it exposes long-term access keys that are not scoped or temporary, increasing risk. Option D is wrong because security group rules control network traffic at the instance level, not IAM-based access; they cannot grant API-level permissions to assume roles or deploy resources.

Practice this question →

252

MCQmedium

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

A.Use AWS CloudFormation StackSets to deploy the Auto Scaling groups consistently.

B.Use AWS Config rules to enforce desired scaling policies.

C.Use AWS Systems Manager Explorer with multi-account management.

D.Use Amazon CloudWatch cross-account dashboards.

AnswerC

Systems Manager Explorer provides a central dashboard for operational data across accounts.

Why this answer

AWS Systems Manager Explorer provides a single-pane-of-glass view across multiple AWS accounts and Regions, allowing the operations team to view and modify EC2 Auto Scaling policies centrally. It integrates with Systems Manager Automation runbooks to execute changes, such as updating scaling policies, across all accounts managed via AWS Organizations.

Exam trap

The trap here is that candidates confuse monitoring (CloudWatch dashboards) or compliance (Config rules) with the ability to both view and modify operational configurations, leading them to overlook Systems Manager Explorer's centralized management capabilities.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets deploy and manage infrastructure consistently but do not provide a centralized operational interface to view or modify existing Auto Scaling scaling policies in real time. Option B is wrong because AWS Config rules are used for compliance auditing and remediation, not for interactive viewing or modification of scaling policies. Option D is wrong because Amazon CloudWatch cross-account dashboards enable monitoring of metrics but do not allow modification of Auto Scaling policies or provide a management interface for scaling actions.

Practice this question →

253

Multi-Selecthard

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Select 2 answers

A.Apply a tag policy to the development OU that requires tags for all resources.

B.Modify the root-level SCP to deny the unwanted services.

C.Use a service control policy that denies access to the unwanted services and attach it to the development OU.

D.Attach a deny SCP to the development OU that explicitly denies the unwanted services.

E.Create an IAM permissions boundary for all users in the development OU.

AnswersC, D

Deny SCPs are effective for restricting services.

Why this answer

Tag policies enforce tagging requirements, not service restrictions. Option B is incorrect because modifying the root-level SCP would affect all OUs, not just the development OU. Option C is correct: attaching a deny SCP to the development OU that denies unwanted services will restrict that OU only, as SCPs are inherited but explicit denies override allows.

Option D is correct: similarly, an explicit deny SCP attached to the development OU will block those services for that OU. Option E is incorrect because IAM permissions boundaries are applied to IAM principals, not OUs, and do not override SCPs. Therefore, the correct answers are C and D.

Practice this question →

254

MCQhard

A company has a complex AWS environment with multiple accounts and VPCs. The company wants to ensure that all outbound traffic from VPCs goes through a centralized inspection VPC for security monitoring. The company uses AWS Transit Gateway. Which solution should be implemented?

A.Deploy AWS Network Firewall in each VPC and configure routing to send outbound traffic through the firewall.

B.Use VPC peering to connect all VPCs to the inspection VPC and configure routes.

C.Use Route 53 Resolver to forward all outbound DNS queries to the inspection VPC.

D.Create a Transit Gateway with route tables. Attach the inspection VPC as a central hub. Configure the route tables of the transit gateway to point the default route (0.0.0.0/0) to the inspection VPC attachment. Then attach all other VPCs and configure their route tables to send traffic to the Transit Gateway.

AnswerD

Transit Gateway route tables can direct traffic to inspection VPC.

Why this answer

It uses AWS Transit Gateway with centralized route tables to force all outbound traffic from attached VPCs through the inspection VPC. By configuring the Transit Gateway route table with a default route (0.0.0.0/0) pointing to the inspection VPC attachment, all outbound traffic from other VPCs is routed to the inspection VPC for security monitoring before leaving the network. This design meets the requirement of a single, centralized inspection point without requiring VPC peering or per-VPC firewall deployments.

Exam trap

The trap here is that candidates often confuse VPC peering with Transit Gateway, assuming peering can achieve transitive routing, but AWS VPC peering explicitly does not support transitive routing, making Option B invalid for centralized inspection.

How to eliminate wrong answers

Option A is wrong because deploying AWS Network Firewall in each VPC creates a decentralized inspection model, not a centralized one, and does not leverage Transit Gateway for traffic flow. Option B is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic cannot be centrally routed through a single inspection VPC without complex full-mesh peering. Option C is wrong because Route 53 Resolver only handles DNS queries, not general outbound traffic (e.g., HTTP, HTTPS, or other IP protocols), and thus cannot enforce security monitoring on all outbound traffic.

Practice this question →

255

MCQmedium

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

A.The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.

B.The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.

C.CloudFormation service role is missing. They need to create a service role with appropriate permissions.

D.The production account's IAM roles are not trusted. They need to update the trust policy.

AnswerB

SCPs can deny actions even to administrators.

Why this answer

SCPs apply to all principals in the account, including administrators, and deny actions even if IAM policies allow them. Since the SCP denies s3:PutBucketPolicy, the development team cannot create the bucket policy despite having full admin access. Option A is incorrect because the team does have IAM permissions (admin), but the SCP overrides them.

Option C is incorrect because CloudFormation's service role is not the issue; the SCP restriction affects all principals, including CloudFormation. Option D is incorrect because the trust policy of the production account's IAM roles is unrelated to the SCP in the development account.

Practice this question →

256

Multi-Selecteasy

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Select 3 answers

A.Manually create an S3 bucket in each account to store Config logs.

B.Use an SCP to prevent disabling of AWS Config in any account.

C.Configure the central S3 bucket policy to allow cross-account log delivery from all accounts in the organization.

D.Enable AWS Config in the management account and use Control Tower's account factory to propagate the configuration to all accounts.

E.Create an IAM role in each account to allow the management account to access Config logs.

AnswersB, C, D

SCPs can deny actions that disable Config.

Why this answer

AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Exam trap

The trap here is that candidates often think they need to create IAM roles in each account for cross-account logging, but AWS Config's native cross-account delivery only requires a properly configured S3 bucket policy and does not rely on IAM roles in the member accounts.

Practice this question →

257

Multi-Selectmedium

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Select 2 answers

A.Deploy VPC endpoints in each account for communication

B.Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager

C.Create VPC attachments in each account to connect to the shared Transit Gateway

D.Establish VPC peering connections between each account and the central networking account

E.Set up AWS Direct Connect between all accounts

AnswersB, C

RAM allows sharing the Transit Gateway with other accounts.

Why this answer

AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Exam trap

The trap here is that candidates confuse VPC endpoints (used for service access) with Transit Gateway (used for VPC-to-VPC routing), or assume VPC peering is sufficient for multi-account scalability despite its non-transitive nature and management overhead.

Practice this question →

258

MCQmedium

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

A.The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

B.Some accounts have manually created resources that conflict with the stack set template's resources.

C.The network team does not have sufficient IAM permissions to update stacks in those accounts.

D.The stack set was previously drift-detected and the drift is preventing updates.

AnswerB

If a resource with the same logical ID already exists outside the stack, CloudFormation cannot update the stack and throws an error.

Why this answer

StackSets deploy a common template across accounts. If a resource defined in the template (e.g., a subnet with a specific CIDR) already exists in an account due to manual creation or prior configuration, the update fails with a 'resource already exists' error. Option A is incorrect because OU configuration affects initial deployment, not updates, and the error is about resource conflict, not OU coverage.

Option C is incorrect because IAM permissions would cause an 'access denied' error, not a resource conflict. Option D is incorrect because drift detection does not prevent updates; it only reports differences.

Practice this question →

259

MCQmedium

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

A.Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

B.Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

C.Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

D.Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.

AnswerD

SCPs can deny API calls based on conditions, enforcing tagging across all accounts.

Why this answer

A service control policy (SCP) can deny the s3:CreateBucket action unless the request includes a 'CostCenter' tag, using the 'aws:RequestTag' condition key. This enforces tagging at the point of creation across all accounts in the organization, preventing untagged buckets from being created in the first place, which is the most operationally efficient approach as it avoids the need for remediation or post-creation tagging.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config or Lambda because they are familiar with auto-remediation, but they overlook that SCPs can proactively deny API calls based on request parameters, which is more operationally efficient and aligns with the 'prevent rather than remediate' best practice.

How to eliminate wrong answers

Option A is wrong because using a Lambda function triggered by CloudTrail is reactive and less efficient; it requires setting up CloudTrail, Lambda, and permissions, and there is a delay between bucket creation and tagging, during which the bucket is untagged and could be used. Option B is wrong because an AWS Config rule can only detect non-compliant buckets and trigger auto-remediation (e.g., via a custom Lambda), but it is also reactive and adds complexity; it does not prevent creation of untagged buckets, and the remediation may fail if the bucket is created and immediately used. Option C is wrong because CloudFormation StackSets can only enforce tagging for buckets created via CloudFormation templates, not for buckets created through the console, CLI, SDK, or other services, leaving a significant gap in enforcement.

Practice this question →

260

MCQhard

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

A.Create a VPC peering connection between each pair of VPCs that need to communicate.

B.Use AWS PrivateLink to connect VPCs to the shared services VPC.

C.Use a single TGW route table for all attachments and control traffic with security groups.

D.Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.

AnswerD

This isolates VPCs from each other while allowing all to reach shared services.

Why this answer

Using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Exam trap

The trap here is that candidates often assume a single TGW route table with security groups can control inter-VPC traffic, but security groups cannot be applied to transit gateway attachments—they only work at the instance or ENI level, and TGW route tables control routing, not filtering.

How to eliminate wrong answers

Option A is wrong because VPC peering connections are point-to-point and do not scale well; they require a separate peering connection for every pair of VPCs, which becomes unmanageable as the number of VPCs grows, and they do not leverage the existing transit gateway. Option B is wrong because AWS PrivateLink is used to expose services privately within a VPC, not to enable general VPC-to-VPC routing; it would only allow VPCs to access specific services in the shared services VPC, not full network-layer communication between all VPCs. Option C is wrong because using a single TGW route table for all attachments would allow all VPCs to communicate with each other by default (since all routes are shared), and security groups cannot be applied to TGW attachments to filter traffic between VPCs—security groups are stateful firewalls for instances, not for transit gateway routing decisions.

Practice this question →

261

MCQhard

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

A.Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.

B.Use IAM Access Analyzer to detect and report IAM user creation.

C.Use an SCP to deny iam:CreateUser across all accounts.

D.Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

AnswerA

Config rule triggers Lambda for automatic remediation and notification.

Why this answer

AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Exam trap

The trap here is that candidates may choose an SCP (Option C) because it prevents IAM user creation, but the question specifically requires detection and automatic remediation (deletion and notification), not just prevention.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is designed to analyze resource-based policies for unintended cross-account access, not to detect or report IAM user creation events. Option C is wrong because an SCP that denies iam:CreateUser would prevent IAM user creation proactively, but the question explicitly requires detection and automatic remediation (deletion and notification), not just prevention. Option D is wrong because a CloudWatch alarm on a metric filter for iam:CreateUser can only trigger a notification; it cannot automatically delete the IAM user, so it lacks the remediation step required by the question.

Practice this question →

262

Multi-Selecthard

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Select 3 answers

A.Create an SCP that denies all actions in non-approved regions.

B.Enable AWS Config rules to detect untagged resources and automatically apply the required tag.

C.Use IAM policies in each account to deny actions in non-approved regions.

D.Define a tag policy using AWS Organizations to enforce cost center tags.

E.Create an SCP that denies the creation of resources that do not have a cost center tag.

AnswersA, B, E

SCPs can centrally deny actions in specific regions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can be used to deny all actions in non-approved regions by specifying a condition key like 'aws:RequestedRegion' with a list of allowed regions. This effectively prevents developers in any member account from creating or interacting with resources outside the approved set, regardless of their IAM permissions.

Exam trap

The trap here is that candidates often confuse tag policies (which only enforce compliance after creation) with SCPs that can deny creation of untagged resources, and they mistakenly think IAM policies can be centrally managed across accounts when only SCPs provide organization-wide enforcement.

Practice this question →

263

MCQeasy

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

A.Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.

B.Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

C.Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

D.Use AWS Systems Manager to enforce the AMI ID requirement.

AnswerA

SCPs can restrict actions at the account level and are effective for preventive controls.

Why this answer

SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive.

Option D is wrong because service control policies are the right mechanism.

Practice this question →

264

MCQmedium

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

A.The workload accounts have not accepted the resource share invitation.

B.The workload accounts have a default VPC that conflicts with the shared subnet.

C.The workload accounts do not have the necessary IAM permissions to use shared subnets.

D.The subnet is in a different AWS Region than the workload accounts.

AnswerA

AWS RAM requires the workload accounts to accept the resource share invitation before they can see and use the shared subnet. Until acceptance, the subnet is not visible.

Why this answer

AWS RAM requires workload accounts to accept the resource share invitation before they can see and use the shared subnet. Option B is incorrect because having a default VPC in the workload account does not prevent visibility of shared subnets; the subnet will appear in the VPC list regardless. Option C is incorrect because the primary issue is the acceptance of the resource share, not IAM permissions; while IAM permissions may be needed to launch instances, the subnet itself will not be visible until the share is accepted.

Option D is incorrect because AWS RAM supports sharing across regions, so a different region would not prevent the subnet from being visible after acceptance.

Practice this question →

265

MCQmedium

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

A.Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

B.Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

C.Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.

D.Use Athena with federated query to scan logs directly from the application accounts.

AnswerC

Correct: Partitioning reduces data scanned.

Why this answer

Partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Exam trap

The trap here is that candidates may confuse Athena’s ability to query compressed formats (like Parquet) with the need for partitioning, or mistakenly believe that S3 Glacier can be queried by Athena, when in fact Athena requires objects to be in S3 Standard, Intelligent-Tiering, or Glacier Instant Retrieval (not Glacier or Glacier Deep Archive).

How to eliminate wrong answers

Option A is wrong because converting logs to Parquet format with AWS Glue improves compression and query performance, but it does not address the need to quickly query recent logs without scanning all historical data; partitioning is still required for cost-effective pruning. Option B is wrong because transitioning logs to S3 Glacier after 7 days makes them inaccessible to Athena, as Athena cannot query data stored in Glacier or Glacier Deep Archive storage classes. Option D is wrong because Athena federated query is designed to query data in external databases (e.g., RDS, DynamoDB) or on-premises sources, not to scan logs directly from S3 buckets in other accounts; cross-account S3 access is handled via bucket policies, not federated query.

Practice this question →

266

MCQhard

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

A.The workload account must create a route table entry in the shared VPC to allow communication.

B.The workload account must configure security groups for the EC2 instance to allow traffic to the RDS database's security group.

C.Establish a VPC peering connection between the workload account's VPC and the shared VPC.

D.Attach an AWS Transit Gateway to both VPCs to enable communication.

AnswerB

Security groups are managed by the account that owns the resource.

Why this answer

When an EC2 instance is launched into a shared subnet via AWS RAM, the workload account can manage its own security groups, but the underlying VPC and its route tables remain under the management of the VPC owner. Since the instance and the RDS database are in the same VPC, no inter-VPC connectivity (like VPC peering or Transit Gateway) is needed. The only missing piece is that the workload account must configure its EC2 instance's security group to allow outbound traffic to the RDS database's security group, and the RDS database's security group must allow inbound traffic from the EC2 instance's security group, both of which are standard security group rules within the same VPC.

Exam trap

The trap here is that candidates assume that because the subnet is shared across accounts, the resources are in different VPCs, leading them to incorrectly select VPC peering or Transit Gateway options, when in fact the resources are in the same VPC and only need proper security group configuration.

How to eliminate wrong answers

Option A is wrong because route table entries are managed by the VPC owner, not by the workload account, and within the same VPC the default route table already enables communication between subnets; no additional route entry is required. Option C is wrong because a VPC peering connection is used to connect two different VPCs, but the EC2 instance and the RDS database reside in the same VPC (the shared VPC), so peering is unnecessary and would add complexity. Option D is wrong because an AWS Transit Gateway is designed to interconnect multiple VPCs or on-premises networks, but here both resources are already in the same VPC, making Transit Gateway redundant and incorrect.

Practice this question →

267

MCQhard

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

A.Use an SCP to enforce a specific password policy and require MFA across all accounts.

B.Use AWS Config rules to automatically set the password policy and enable MFA for all users.

C.Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.

D.Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

AnswerC

SCPs can block actions that modify the password policy or deactivate MFA, and AWS Config can detect non-compliant users.

Why this answer

SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Exam trap

The trap here is that candidates assume SCPs can enforce configurations like password policies or MFA, but SCPs only deny or allow actions, not set or enable features, so detection and remediation require AWS Config or similar services.

How to eliminate wrong answers

Option A is wrong because SCPs cannot enforce a specific password policy or require MFA; they can only deny or allow actions, not set configurations or enable features. Option B is wrong because AWS Config rules can detect non-compliance but cannot automatically set a password policy or enable MFA for users; they only evaluate and report. Option D is wrong because AWS CloudTrail only logs API calls and does not provide enforcement or remediation; automatic remediation would require additional services like AWS Config with auto-remediation or Lambda, not CloudTrail alone.

Practice this question →

268

MCQmedium

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

A.Use AWS Config rules to detect and remediate public buckets in each account.

B.Create a CloudFormation StackSet to deploy bucket policies in every account.

C.Use IAM roles to restrict users from modifying bucket public access settings.

D.Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.

AnswerD

SCPs prevent the action across all accounts in the OU.

Why this answer

An SCP applied to the root OU is the most efficient way to enforce a blanket denial of public access to S3 buckets across all accounts in AWS Organizations. It prevents any account, including root users, from performing the s3:PutBucketPublicAccessBlock action, ensuring compliance without per-account configuration or remediation.

Exam trap

The trap here is that candidates confuse preventive controls (SCPs) with detective/reactive controls (AWS Config) or assume IAM roles can restrict all users, ignoring that SCPs apply to the root user and all principals in the account.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive and require per-account setup; they detect and remediate after a violation occurs, not prevent it, and incur ongoing costs. Option B is wrong because CloudFormation StackSets deploy resources but cannot prevent users from modifying bucket policies; they also require per-account execution and maintenance. Option C is wrong because IAM roles cannot restrict root users or actions taken via the S3 console that bypass IAM; they also fail to prevent cross-account access or direct API calls from other services.

Practice this question →

269

Multi-Selecteasy

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)

Select 2 answers

A.Use an IAM permissions boundary for all IAM roles.

B.Use S3 Block Public Access at the account level.

C.Use AWS CloudFormation Guard to validate templates before deployment.

D.Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled.

E.Use a service control policy (SCP) to deny s3:CreateBucket if the bucket does not have encryption settings.

AnswersC, E

CloudFormation Guard can enforce encryption settings in templates.

Why this answer

AWS CloudFormation Guard (cfn-guard) allows you to define rules that validate CloudFormation templates before deployment. You can create a rule that checks whether the `BucketEncryption` property is set on every `AWS::S3::Bucket` resource, preventing the creation of unencrypted buckets at the template level. This enforces encryption as a policy-as-code gate in the CI/CD pipeline.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like SCPs or CloudFormation Guard), leading them to select Option D even though it only reports non-compliance after the fact, not preventing the creation of unencrypted buckets.

Practice this question →

270

MCQeasy

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

A.Allow s3:GetObject to the SIEM's IAM role.

B.Use an S3 access point with a network origin policy.

C.Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.

D.Allow s3:GetObject to the SIEM's AWS account ID.

AnswerC

This condition explicitly restricts access to requests originating from the specific VPCE.

Why this answer

Using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` (which restricts to an entire VPC) with `aws:SourceVpce` (which restricts to a specific VPC Endpoint), leading them to incorrectly choose Option B (S3 access point) or a generic allow policy, missing the precise VPCE-level control required.

How to eliminate wrong answers

Option A is wrong because simply allowing `s3:GetObject` to the SIEM's IAM role does not restrict access to a specific VPCE; the SIEM could use that role from any network location, violating the requirement. Option B is wrong because an S3 access point with a network origin policy can restrict access based on the VPC or internet, but it does not support a condition key like `aws:SourceVpce` to enforce a specific VPCE ID; it only allows blocking or allowing traffic from an entire VPC, not a single endpoint. Option D is wrong because allowing `s3:GetObject` to the SIEM's AWS account ID would grant access to any principal in that account, regardless of network path, and does not enforce the VPCE restriction.

Practice this question →

271

MCQmedium

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

A.Use AWS Config rules to detect users without MFA and send alerts.

B.Use AWS CloudTrail to monitor console logins and trigger an automatic remediation.

C.Create an IAM policy in each account that denies access without MFA.

D.Apply a service control policy (SCP) that denies all actions if the user does not have MFA enabled.

AnswerD

SCPs enforce centrally across all accounts in the organization.

Why this answer

A Service Control Policy (SCP) applied at the root or organizational unit (OU) level in AWS Organizations can centrally deny all AWS API actions for any principal that does not have a multi-factor authentication (MFA) device associated with the session. This enforces MFA across all member accounts without requiring individual account-level IAM policy changes, making it the most efficient and scalable solution for the security team's requirement.

Exam trap

The trap here is that candidates often choose Option C (per-account IAM policy) because they think SCPs cannot affect IAM users directly, but SCPs apply to all principals in an account, including IAM users, and are the only way to enforce a blanket MFA requirement across all accounts from a single point.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect non-compliant users and send alerts; they cannot proactively deny access or enforce MFA at the time of login. Option B is wrong because CloudTrail is a logging service that records API calls after they occur; it cannot intercept or block a console login session in real time, and automatic remediation would be reactive, not preventive. Option C is wrong because creating an IAM policy in each account requires manual per-account configuration and does not scale efficiently across many accounts; additionally, IAM policies in individual accounts cannot be enforced from a central point and may be overridden by local administrators.

Practice this question →

272

Multi-Selecteasy

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

Select 2 answers

A.Enable AWS CloudTrail to monitor and alert on production changes.

B.Apply an SCP to the production OU that denies all actions to non-approved IAM roles.

C.Use resource tags to identify development and production resources and enforce policies via SCPs.

D.Create IAM roles in production with no permissions, and allow only a central CI/CD role to assume a privileged role.

E.Use AWS Config rules to detect unauthorized deployments in production.

AnswersB, D

SCPs can effectively block all actions from developers in production.

Why this answer

An SCP attached to the production OU can explicitly deny all actions to any IAM role that is not on an approved list, effectively preventing developers from deploying resources in production. This leverages AWS Organizations to enforce a preventive control at the account level, which cannot be overridden by IAM policies within the account.

Exam trap

The trap here is that candidates often confuse detective controls (CloudTrail, Config) with preventive controls (SCPs, IAM policies), leading them to select options that only alert or audit rather than block the action entirely.

Practice this question →

273

MCQeasy

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

A.Use SAML 2.0 federation between AWS SSO and the on-premises AD.

B.Use AWS IAM Identity Center with an external identity provider that supports SCIM.

C.Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.

D.Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

AnswerA

Correct. AWS IAM Identity Center supports SAML 2.0 federation with an external identity provider, such as ADFS, which can use the on-prem Active Directory as the identity source.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) can integrate with an on-premises Active Directory using SAML 2.0 federation. This involves configuring a SAML 2.0 identity provider (such as Active Directory Federation Services) to federate with IAM Identity Center. Option C is incorrect because it describes combining AWS Managed Microsoft AD and AD Connector, which is not a valid integration method.

The correct approaches are either using AD Connector alone or AWS Managed Microsoft AD with a trust, not both together. Other options are not viable direct integration methods.

Exam trap

The trap is that many candidates think they need to set up AWS Managed Microsoft AD or AD Connector, but the simplest integration is to use SAML 2.0 federation with an existing on-premises AD.

How to eliminate wrong answers

Option A is wrong because SAML 2.0 federation between AWS SSO and on-premises AD would require an external identity provider (IdP) like ADFS to broker the trust, not a direct integration; AWS SSO cannot directly federate with on-premises AD via SAML without an IdP. Option B is wrong because IAM Identity Center with an external IdP that supports SCIM is used for provisioning users and groups from an external IdP (e.g., Azure AD, Okta), not for connecting to an on-premises AD directly; SCIM does not handle authentication against on-premises AD. Option D is wrong because AWS SSO does not support direct LDAP connections to on-premises Active Directory; it requires a directory service such as AWS Managed Microsoft AD or AD Connector to bridge the connection.

Practice this question →

274

MCQmedium

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

A.The write is denied because the principal is the root user, not an IAM role.

B.The write is allowed because the policy grants access to the root of account 123456789012.

C.The write is denied because the policy only allows GetObject, not PutObject.

D.The write is allowed only if the object key is exactly 'AWSLogs/123456789012/'.

AnswerB

Correct: the root principal covers all IAM entities in that account.

Why this answer

The S3 bucket policy grants access to the root user of account 123456789012 (the `Principal` is the AWS account root user via the account ARN). When a service in that account writes to the bucket, the request is made on behalf of the account, and the root user effectively owns all identities in the account. The policy allows `s3:PutObject` on the `AWSLogs/123456789012/*` prefix, so the write to `s3://my-log-bucket/AWSLogs/123456789012/logfile.txt` is permitted.

Option B correctly identifies that the root user grant covers the service's action.

Exam trap

The trap here is that candidates often assume a root user principal only applies to the literal root user credentials, not to all identities in the account, leading them to incorrectly think the service's write would be denied.

How to eliminate wrong answers

Option A is wrong because the policy grants access to the root user of account 123456789012, not an IAM role, and the root user can delegate permissions to services within the account; the write is not denied on that basis. Option C is wrong because the policy explicitly includes `s3:PutObject` in the `Action` list (the exhibit shows `s3:PutObject` as part of the allowed actions), so the write is not denied due to missing PutObject permission. Option D is wrong because the policy uses a wildcard `AWSLogs/123456789012/*` which allows any object key under that prefix, not an exact match to `AWSLogs/123456789012/`.

Practice this question →

275

MCQeasy

A company has a centralized logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all member accounts in AWS Organizations. The logs are stored in an S3 bucket in the logging account. Security analysts need to query these logs using Amazon Athena. What is the MOST efficient way to set up the table partitions?

A.Use AWS Glue Crawler to create a table with no partitions, and query the entire dataset each time.

B.Use AWS Glue Crawler to automatically create partitions based on the date prefix in the S3 key.

C.Use AWS Glue Crawler to create a table, then manually add partitions for each account ID and region.

D.Use AWS Glue Crawler to create a table partitioned by log type and date.

AnswerC

Partitioning by account and region optimizes query performance for multi-account environments.

Why this answer

VPC Flow Logs, CloudTrail, and AWS Config logs are stored in S3 with key prefixes that include account ID, region, and date (e.g., AWSLogs/{account-id}/CloudTrail/{region}/{year}/{month}/{day}/). To efficiently query these logs in Athena, partitions should be created on account ID and region to enable partition pruning, reducing the amount of data scanned. Manually adding partitions for each account ID and region ensures precise control and avoids the overhead of crawling all historical data, which is more efficient than relying solely on automatic date-based partitioning.

Exam trap

The trap here is that candidates assume AWS Glue Crawler can automatically create optimal partitions for multi-account log structures, but it typically only partitions on the last directory level (e.g., date), missing the account ID and region partitions that are crucial for query performance in a centralized logging setup.

How to eliminate wrong answers

Option A is wrong because querying the entire dataset without partitions would scan all objects in the S3 bucket, leading to high costs and poor performance, especially as log volume grows. Option B is wrong because while Glue Crawler can automatically create partitions based on date prefixes, this approach does not include partitions for account ID and region, which are essential for filtering logs from specific accounts or regions; without these, queries would still scan unnecessary data. Option D is wrong because partitioning by log type and date alone ignores account ID and region, which are critical for security analysts who need to isolate logs from specific member accounts or regions; this would result in scanning more data than necessary.

Practice this question →

276

MCQmedium

A financial services company is migrating its trading platform to AWS. The platform consists of hundreds of microservices deployed in containers using Amazon ECS with Fargate launch type. Each service has its own IAM role for fine-grained permissions. The security team requires that all ECS tasks use a specific VPC (vpc-12345) and cannot run in any other VPC. During a recent audit, it was discovered that some tasks are running in a different VPC (vpc-67890). The solutions architect must implement a preventive control to ensure that ECS tasks only run in the approved VPC. The company uses AWS Organizations and has Service Control Policies (SCPs) in place. What should the solutions architect do?

A.Tag the approved VPC and use IAM policies to allow ECS actions only when the VPC tag matches.

B.Add an IAM policy to each ECS task role that denies the action if the VPC is not the approved one.

C.Create an SCP that denies ecs:RunTask and ecs:CreateService unless the networkConfiguration.awsvpcConfiguration.subnets are in the approved VPC.

D.Use AWS Config rules to detect tasks running in non-approved VPCs and trigger a remediation action.

AnswerC

SCPs provide preventive controls at the organization level.

Why this answer

Service Control Policies (SCPs) in AWS Organizations provide a preventive control that applies across all accounts in the organization. By denying ecs:RunTask and ecs:CreateService unless the subnets specified in networkConfiguration.awsvpcConfiguration belong to the approved VPC (vpc-12345), the SCP enforces the VPC constraint at the organization level, preventing any task from launching in a non-approved VPC regardless of individual IAM roles or account configurations.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or they mistakenly think IAM policies on task roles can control the launch VPC, when in fact the launch VPC is determined by the caller's permissions and SCPs, not the task's IAM role.

How to eliminate wrong answers

Option A is wrong because IAM policies cannot condition on tags of resources that are not the resource being acted upon (e.g., a VPC tag) in a way that prevents the ECS task from launching in a different VPC; IAM conditions like 'ecs:VpcId' do not exist, and tagging the VPC does not enforce the constraint at the API call level. Option B is wrong because IAM policies attached to ECS task roles control what the task can do after it runs, not whether the task can be launched in a particular VPC; the task role is assumed by the task, not by the caller that creates or runs the task. Option D is wrong because AWS Config rules are detective controls, not preventive controls; they can detect non-compliant tasks and trigger remediation, but they do not prevent the task from running in the first place, which is the requirement for a preventive control.

Practice this question →

277

MCQmedium

A company has a multi-account AWS environment. They want to ensure that any new account created in the organization automatically gets a specific set of IAM roles and AWS Config rules deployed. Which solution requires the least manual effort?

A.Use AWS Organizations and attach a tag policy that requires the roles and rules.

B.Use AWS CloudFormation StackSets with automatic deployment to the organization.

C.Attach an SCP to the root OU that creates the roles and rules.

D.Use AWS Lambda to periodically scan for new accounts and deploy resources.

AnswerB

StackSets can automatically deploy stacks to new accounts when enabled.

Why this answer

AWS CloudFormation StackSets with automatic deployment to the organization is the correct solution because it allows you to define a set of AWS resources (IAM roles, Config rules) as a CloudFormation template and automatically deploy it to every account in the organization, including newly created accounts, without any manual intervention. StackSets can be configured to deploy to all accounts in the organization or specific OUs, and they automatically handle the deployment to new accounts as they join the organization.

Exam trap

The trap here is that candidates often confuse the capabilities of SCPs (which only deny or allow actions) with the resource-provisioning capabilities of CloudFormation StackSets, leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because tag policies are used to enforce consistent tagging on resources, not to create or deploy IAM roles or AWS Config rules. Option C is wrong because SCPs (Service Control Policies) are used to restrict permissions and actions at the account level, not to create resources; they cannot create IAM roles or Config rules. Option D is wrong because using a periodic Lambda function to scan for new accounts and deploy resources requires ongoing maintenance, introduces potential latency, and is less reliable than the native, event-driven deployment provided by StackSets.

Practice this question →

278

MCQmedium

A company has a management account in AWS Organizations and wants to share a central Amazon VPC subnet with multiple member accounts for a shared services VPC. Which AWS service should be used to share the subnet?

A.VPC peering connection

B.AWS Resource Access Manager

C.AWS PrivateLink

D.Service control policy

AnswerB

RAM allows sharing subnets across accounts within an organization.

Why this answer

AWS Resource Access Manager (RAM) is the correct service because it enables you to share a central VPC subnet from a management account with multiple member accounts in AWS Organizations without requiring VPC peering or transit gateways. With RAM, you create a resource share that includes the subnet and specify the member accounts or organizational units (OUs) to grant them access, allowing those accounts to launch resources directly into the shared subnet while maintaining centralized network management.

Exam trap

The trap here is that candidates often confuse VPC peering (which connects entire VPCs) with subnet sharing (which allows direct resource placement into a shared subnet), leading them to select VPC peering instead of AWS Resource Access Manager.

How to eliminate wrong answers

Option A (VPC peering connection) is wrong because VPC peering connects entire VPCs at the network layer using private IP addresses, but it does not allow you to share a subnet; it only enables routing between VPCs, and each account still needs its own subnet. Option C (AWS PrivateLink) is wrong because PrivateLink provides private connectivity to services via interface VPC endpoints powered by AWS PrivateLink, not for sharing subnets or VPC resources across accounts. Option D (Service control policy) is wrong because SCPs are used to manage permissions and enforce guardrails across accounts in AWS Organizations, not for sharing infrastructure resources like subnets.

Practice this question →

279

MCQhard

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

A.Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

B.Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

C.Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.

D.Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

AnswerC

Network Manager can auto-accept attachments based on tags.

Why this answer

AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Exam trap

The trap here is that candidates may think a Lambda function or AWS Config is needed for automation, but AWS Transit Gateway Network Manager provides a native, policy-driven way to automatically accept attachments based on tags, which is simpler and more secure.

How to eliminate wrong answers

Option A is wrong because a Lambda function monitoring for new VPCs would require custom code and event handling, and does not inherently enforce that only approved VPCs can attach; it also lacks the built-in approval mechanism. Option B is wrong because an SCP cannot require tags on VPCs (SCPs restrict actions, not enforce tagging), and AWS Config can detect non-compliance but cannot automatically create transit gateway attachments. Option D is wrong because it requires manual approval by the networking team, which does not meet the requirement for automatic approval.

Practice this question →

280

Multi-Selecteasy

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

Select 2 answers

A.Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.

B.Allow ec2:RunInstances with a condition that the instance type is in an allowed list.

C.Allow ec2:RunInstances without conditions.

D.Deny ec2:RunInstances if the instance type is not in the allowed list.

AnswersA, B

This ensures tagging is enforced.

Why this answer

The IAM policy condition 'ec2:RequestTag/CostCenter' ensures that the developer's RunInstances request includes the required 'CostCenter' tag, enforcing tagging compliance at launch time. Option B is correct because a condition using 'ec2:InstanceType' with a 'ForAllValues:StringLike' or 'StringEquals' operator restricts allowed instance types to a specific list, preventing unauthorized instance families or sizes.

Exam trap

The trap here is that candidates often choose a Deny-based approach (Option D) thinking it is more secure, but they overlook that without an explicit Allow, the implicit deny blocks all actions, and the Deny condition does not enforce the tagging requirement.

Practice this question →

281

MCQmedium

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

A.An IAM policy applied to each account's admin role to restrict instance types.

B.An SCP that allows ec2:RunInstances only for t2.micro.

C.An SCP that denies ec2:RunInstances when the instance type is not t2.micro.

D.An AWS Config rule to terminate non-compliant instances.

AnswerC

Deny SCPs block non-compliant actions.

Why this answer

An SCP that denies ec2:RunInstances when the instance type is not t2.micro will prevent launching any instance type other than t2.micro. SCPs are centralized and can be applied to OUs. Option A is incorrect because IAM policies are per-account and not centralized.

Option B is incorrect because an allow SCP by itself would only allow t2.micro but would not prevent other instance types unless the default is to deny all, which is not the case. Option D is incorrect because AWS Config rules are reactive and do not prevent actions; they only detect and can remediate after the fact.

Practice this question →

282

MCQmedium

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

A.Use AWS Direct Connect to connect each application account to the transit gateway.

B.Establish VPC peering connections between each application account and the network account.

C.Use AWS Resource Access Manager (RAM) to share the transit gateway with authorized accounts.

D.Create an SCP that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account.

AnswerC

RAM allows sharing of transit gateways with specific accounts.

Why this answer

AWS Resource Access Manager (RAM) allows the network account to share the transit gateway with specific application accounts, enabling them to create attachments without granting them ownership or management of the transit gateway itself. This approach ensures that only authorized accounts can create VPC attachments to the shared transit gateway, as the sharing is controlled at the resource level and can be revoked at any time.

Exam trap

The trap here is that candidates may confuse service control policies (SCPs) with resource-based policies or RAM, thinking that an SCP can selectively allow specific accounts to create attachments, when in fact SCPs only deny or allow permissions at the account level and cannot grant permissions that the account does not already have via IAM or RAM.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a mechanism to authorize or control which accounts can create transit gateway attachments; it does not address account-level authorization. Option B is wrong because VPC peering connections are point-to-point connections between two VPCs and do not integrate with a transit gateway; they also do not provide a centralized way to authorize multiple accounts to attach to a shared transit gateway. Option D is wrong because a service control policy (SCP) that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account would prevent application accounts from creating any transit gateway attachments, even if they are authorized via RAM; SCPs are used to set permission boundaries, not to selectively grant attachment permissions to specific accounts.

Practice this question →

283

MCQhard

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

A.Create VPC peering connections between all VPCs and use security groups for inspection

B.Configure a VPN between each VPC and a central virtual appliance

C.Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC

D.Use AWS Direct Connect to connect all VPCs to a common router

AnswerC

Transit Gateway provides transitive routing and central inspection.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Exam trap

The trap here is that candidates often confuse VPC peering (which is simple but unscalable and lacks central inspection) with Transit Gateway, or they incorrectly assume that Direct Connect or VPNs are designed for inter-VPC connectivity rather than hybrid connectivity to on-premises.

How to eliminate wrong answers

Option A is wrong because VPC peering creates a full-mesh topology that does not scale beyond a few VPCs, and security groups cannot inspect traffic between VPCs (they are stateful firewalls at the instance/ENI level, not a central inspection point). Option B is wrong because configuring a VPN between each VPC and a central virtual appliance introduces bandwidth limitations, latency from encryption overhead, and operational complexity for routing and failover; it also does not leverage native AWS networking constructs for high availability. Option D is wrong because AWS Direct Connect provides dedicated physical connectivity to on-premises networks, not private connectivity between VPCs; it would require additional routing and does not inherently provide centralized traffic inspection.

Practice this question →

284

Multi-Selecthard

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Select 3 answers

A.Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.

B.Create a new S3 bucket in each account to store GuardDuty findings.

C.Designate a delegated administrator account for GuardDuty in AWS Organizations.

D.Enable Amazon GuardDuty in each member account.

E.Use the delegated administrator account to view findings from all accounts in the GuardDuty console.

AnswersC, D, E

The delegated admin can manage GuardDuty across accounts.

Why this answer

Designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Exam trap

The trap here is that candidates might think sending findings to CloudWatch Logs or S3 is the correct way to centralize management, but AWS's native multi-account architecture for GuardDuty relies on the delegated administrator and member account model, not log aggregation.

Practice this question →

285

Multi-Selectmedium

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

Select 2 answers

A.Create IAM roles in each member account to allow AWS Backup to assume them.

B.Create a separate backup policy for each member account.

C.Create a backup vault in the management account and share it with member accounts.

D.Create a backup vault in each member account and aggregate them using AWS Config.

E.Enable AWS Backup as a trusted service within AWS Organizations.

AnswersC, E

Allows member accounts to use the central vault.

Why this answer

Options C and E are correct. Option A is incorrect because IAM roles are not created automatically for AWS Backup; instead, the backup policy is applied via AWS Organizations. Option B is incorrect because a single backup policy can be applied to the entire organization or specific organizational units, not per account.

Option D is incorrect because the backup vault should be in the management account, not in each member account. Option E is correct because enabling AWS Backup as a trusted service within AWS Organizations allows the management account to centrally manage backup policies across member accounts. Option C is correct because sharing the backup vault from the management account allows member accounts to store backups in the central vault.

Practice this question →

286

MCQmedium

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

A.Create a separate VPC in each account and connect them with VPC peering.

B.Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.

C.Set up an AWS Transit Gateway and attach the VPCs from each account.

D.Create VPC peering connections between the networking account and each workload account.

AnswerB

RAM enables subnet sharing with minimal overhead.

Why this answer

AWS Resource Access Manager (RAM) allows you to share a subnet from a central VPC in the networking account with other AWS accounts without creating separate VPCs or complex networking. This enables workload accounts to launch resources directly into the shared subnet, achieving low latency by keeping them in the same VPC and Availability Zone. RAM handles the cross-account sharing with minimal operational overhead, as it does not require additional network appliances or routing configuration.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing Transit Gateway or VPC peering, thinking they need to interconnect VPCs, when the simplest and most cost-effective approach is to share the existing subnet directly using AWS RAM.

How to eliminate wrong answers

Option A is wrong because creating separate VPCs in each account and connecting them with VPC peering introduces additional complexity, does not share a single subnet, and VPC peering is not transitive, requiring full mesh connectivity for multiple accounts. Option C is wrong because AWS Transit Gateway adds operational overhead for managing attachments, route tables, and potentially higher costs, while the requirement is simply to share a subnet, not to interconnect multiple VPCs. Option D is wrong because VPC peering connections between the networking account and each workload account would require managing multiple peering connections and routing updates, and does not allow direct sharing of a subnet; resources would still be in separate VPCs, potentially increasing latency.

Practice this question →

287

MCQeasy

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

A.Use AWS Lambda to re-enable GuardDuty if it is disabled.

B.Create an AWS Config rule to detect disabled GuardDuty and send alerts.

C.Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.

D.Attach an IAM policy to each user that denies guardduty:Disable* actions.

AnswerC

SCPs prevent the actions across all accounts in the OU, regardless of user permissions.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Exam trap

The trap here is that candidates often choose a detective or reactive solution (like AWS Config or Lambda) because they overlook the requirement to *prevent* the action, or they mistakenly believe IAM policies attached to users are sufficient to block all principals, including the root user and cross-account roles.

How to eliminate wrong answers

Option A is wrong because using AWS Lambda to re-enable GuardDuty is a reactive, non-preventive approach; it does not block the disable action itself, and there is a window of vulnerability between the disable event and the Lambda execution. Option B is wrong because an AWS Config rule can only detect and alert on a non-compliant state (e.g., GuardDuty disabled), but it cannot prevent the disable action from occurring. Option D is wrong because IAM policies attached to individual users do not prevent the root user or other principals (such as roles or services) from disabling GuardDuty, and they are not enforceable across all accounts in the OU without manual, error-prone replication.

Practice this question →

288

MCQmedium

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

A.Use AWS Service Catalog to enforce tagging on provisioned products.

B.Run a Lambda function that tags resources after creation based on the creator's cost center.

C.Use AWS Config rules to mark non-compliant resources and auto-remediate.

D.Apply an SCP that denies ec2:RunInstances unless the request includes the CostCenter tag.

AnswerD

SCP can enforce tag requirements at creation time.

Why this answer

An SCP that denies ec2:RunInstances unless the request includes the CostCenter tag enforces tag propagation at the point of resource creation. This is a preventive control that blocks non-compliant actions before they happen, ensuring all EC2 instances are tagged from the start. It leverages AWS Organizations to apply the policy across all accounts in the specified OUs, providing centralized enforcement without relying on post-creation remediation.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config auto-remediation (Option C) because they are familiar with it, but the question asks for the 'BEST' way to enforce tag propagation, which requires a preventive control (SCP) to stop untagged resources from being created in the first place.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog only enforces tagging on provisioned products created through the catalog, not on resources created directly via APIs or other services, leaving gaps in coverage. Option B is wrong because a Lambda function that tags resources after creation is a detective/reactive approach that cannot prevent untagged resources from being created, and it may fail if the creator's cost center cannot be reliably determined. Option C is wrong because AWS Config rules are detective and auto-remediation is reactive—non-compliant resources can exist temporarily, incurring costs without proper tagging, and auto-remediation may not cover all resource types or may have execution delays.

Practice this question →

289

MCQhard

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

A.No, because the source identity does not match.

B.Yes, because the role in account 222222222222 is allowed by the principal.

C.No, because cross-account role assumption is not allowed.

D.Yes, because the source identity condition is optional.

AnswerA

The condition requires source identity 'central-admin', but it is 'admin'.

Why this answer

The assumption fails because the trust policy on AuditRole includes a `sts:SourceIdentity` condition that requires the source identity to match a specific value (e.g., 'auditor'), but the session is launched with source identity 'admin'. Since the condition is not satisfied, AWS STS denies the AssumeRole API call, even though the principal (the Admin role in account 222222222222) is allowed by the `Principal` element. The `sts:SourceIdentity` condition key is evaluated at request time and must match exactly for the policy to grant access.

Exam trap

The trap here is that candidates assume a trust policy only needs a matching principal and action to succeed, overlooking that condition keys like `sts:SourceIdentity` can independently deny the request even when the principal is valid.

How to eliminate wrong answers

Option B is wrong because while the principal is allowed, the trust policy also includes an `sts:SourceIdentity` condition that must be satisfied; the condition fails due to mismatched source identity, so the assumption is denied. Option C is wrong because cross-account role assumption is explicitly allowed when the trust policy grants access to a principal from another account, which is the case here. Option D is wrong because the `sts:SourceIdentity` condition is not optional—it is a required condition in the policy statement, and if it is present, it must be satisfied for the request to succeed.

Practice this question →

290

Multi-Selectmedium

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Select 2 answers

A.Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.

B.Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

C.Enable IAM Access Analyzer to review and identify IAM roles that grant permissions to external principals or have unused permissions.

D.Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

E.Enable AWS Resource Access Manager to share resources only with trusted accounts.

AnswersA, C

SCPs enforce preventive controls at the organization level.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Exam trap

The trap here is that candidates often confuse detective controls (like CloudTrail alerts) with preventive controls (like SCPs), assuming monitoring alone is sufficient to enforce least privilege, but the question explicitly asks for actions that 'ensure' compliance, which requires proactive denial, not just detection.

Practice this question →

291

MCQeasy

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

A.AWS Direct Connect gateway

B.VPC peering with full mesh connectivity

C.Elastic Load Balancer

D.AWS Transit Gateway

AnswerD

Transit Gateway supports transitive routing and central inspection VPC architectures.

Why this answer

AWS Transit Gateway (D) is the correct service because it acts as a central hub that can route traffic between multiple VPCs across different accounts, and it supports route tables that can force all inter-VPC traffic through a dedicated inspection VPC (e.g., using a blackhole route or a network appliance). This enables transitive routing without requiring full mesh peering, and it integrates with AWS Resource Access Manager (RAM) for cross-account sharing.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, assuming that a full mesh of peering connections can achieve the same centralized inspection as Transit Gateway, but VPC peering explicitly does not support transitive routing (per AWS documentation), making it impossible to force all traffic through a single inspection VPC without additional, unsupported workarounds.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect gateway is used to connect on-premises networks to AWS via Direct Connect, not for routing traffic between VPCs in different accounts. Option B is wrong because VPC peering with full mesh connectivity does not support transitive routing—each peering connection is a one-to-one relationship, so traffic cannot be forced through a central inspection VPC without complex, non-scalable configurations. Option C is wrong because Elastic Load Balancer is a traffic distribution service for applications, not a routing service for inter-VPC traffic; it cannot route packets between VPCs or enforce inspection paths.

Practice this question →

292

MCQhard

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

A.Apply an SCP to the root OU that denies the organizations:LeaveOrganization action and denies the root user's ability to perform actions.

B.Create an IAM policy that denies the organizations:LeaveOrganization action and attach it to all IAM users.

C.Use AWS Config rules to detect when an account leaves the organization and automatically rejoin it.

D.Use AWS CloudTrail to monitor and alert on root user activity and organizations:LeaveOrganization.

AnswerA

SCPs apply to root user and all IAM entities; can block leave and restrict root.

Why this answer

An SCP attached to the root OU can deny the organizations:LeaveOrganization action for all accounts in the organization, preventing any account from leaving. Additionally, an SCP can deny all actions for the root user in member accounts by using a condition key such as "aws:PrincipalType": "Root", which effectively blocks root user operations without affecting IAM users or roles. This approach enforces both requirements centrally without requiring per-account configuration.

Exam trap

The trap here is that candidates often assume IAM policies can control root user behavior, but root user is not subject to IAM policies; only SCPs (or a strong password policy with MFA) can restrict root user actions, and SCPs are the only way to block the LeaveOrganization action across all accounts.

How to eliminate wrong answers

Option B is wrong because an IAM policy attached to IAM users does not apply to the root user, so it cannot prevent the root user from performing actions or leaving the organization; the root user is not bound by IAM policies. Option C is wrong because AWS Config rules cannot rejoin an account to an organization after it has left; they can only detect and report compliance, not execute remediation actions that modify Organizations membership. Option D is wrong because monitoring and alerting with CloudTrail only provides visibility after the fact; it does not proactively block the LeaveOrganization action or restrict root user operations.

Practice this question →

293

Multi-Selecthard

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Select 2 answers

A.Use AWS Config rules to detect users without MFA and send alerts.

B.Enable AWS CloudTrail to log console access without MFA.

C.Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.

D.Use AWS Single Sign-On (SSO) with MFA enabled for all users.

E.Create an IAM policy in each account that denies console access unless aws:MultiFactorAuthPresent is true.

AnswersC, E

SCPs can centrally enforce MFA across all accounts.

Why this answer

A service control policy (SCP) can be applied centrally at the organizational unit or account level to deny all console access unless the `aws:MultiFactorAuthPresent` condition key is `true`. This enforces MFA usage across all member accounts and cannot be overridden by account administrators. Option E is also correct because an IAM policy with the same condition key can be attached to all users or groups within each account, providing an additional layer of enforcement.

Combining both ensures that even if the SCP is bypassed or not applied to a specific account, the IAM policy still enforces MFA. Together, they provide defense in depth.

Exam trap

The trap is that candidates often choose only one of the two preventive controls (SCP or IAM policy) or confuse detective controls (like AWS Config or CloudTrail) with preventive controls. The question requires combining two approaches to enforce MFA across all accounts, and both SCPs and IAM policies are needed for a robust, multi-account strategy. SCPs provide centralized guardrails, while IAM policies provide per-account enforcement that cannot be circumvented by any role that might bypass SCPs.

Practice this question →

294

Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Select 2 answers

A.Use AWS Trusted Advisor to alert when CloudTrail is disabled.

B.Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.

C.Use AWS Shield Advanced to protect CloudTrail.

D.Use AWS Config rules with auto-remediation to re-enable CloudTrail if disabled.

E.Use IAM permissions boundaries to restrict user permissions.

AnswersB, D

SCPs can prevent disabling actions at the organizational level.

Why this answer

A Service Control Policy (SCP) is a centralized policy in AWS Organizations that can deny specific actions across all accounts in the organization. By attaching an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `cloudtrail:UpdateTrail` actions, you can prevent any user or role, including the root user, from disabling or deleting CloudTrail, ensuring compliance with the multi-account strategy.

Exam trap

The trap here is that candidates often confuse IAM permissions boundaries or Trusted Advisor alerts as preventive controls, but only SCPs provide a true preventive guardrail that cannot be overridden by account administrators.

Practice this question →

295

Multi-Selecthard

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Select 3 answers

A.Attach the VPCs in member accounts to the transit gateway.

B.Update the route tables of the VPCs to point to the transit gateway for inter-VPC traffic.

C.Create VPC endpoints for the transit gateway in each VPC.

D.Create VPC peering connections between each VPC and the networking VPC.

E.Share the transit gateway with the member accounts using AWS Resource Access Manager.

AnswersA, B, E

VPCs must be attached to the transit gateway to route traffic through it.

Why this answer

Attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.

Exam trap

The trap here is that candidates often confuse VPC endpoints (used for AWS service access) with transit gateway attachments, or mistakenly think VPC peering is required when the transit gateway already provides the necessary connectivity.

Practice this question →

296

MCQeasy

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

A.Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.

B.Use the IAM Identity Center console to add the member account as a delegated administrator.

C.Use a service control policy to allow the member account to manage IAM Identity Center.

D.Create an IAM role in the management account and allow the member account to assume it.

AnswerB

This is the native mechanism for delegation.

Why this answer

AWS IAM Identity Center allows you to designate a member account as a delegated administrator directly from the IAM Identity Center console in the management account. This grants the member account the necessary permissions to manage users, groups, and permission sets without requiring cross-account roles or resource sharing.

Exam trap

The trap here is that candidates often confuse delegation with resource sharing via RAM or assume that SCPs can grant permissions, when in fact delegation is a specific AWS Organizations feature that must be configured through the IAM Identity Center console or API for that service.

How to eliminate wrong answers

Option A is wrong because AWS Resource Access Manager (RAM) is used to share resources like subnets or license configurations, not to delegate administrative control of IAM Identity Center; IAM Identity Center instances are not shareable via RAM. Option C is wrong because service control policies (SCPs) are used to restrict permissions across accounts in an organization, not to grant or delegate administrative capabilities; SCPs cannot enable a member account to manage IAM Identity Center. Option D is wrong because creating an IAM role in the management account for the member account to assume would provide access to the management account's IAM Identity Center configuration, but it does not delegate administration; the member account would still operate under the management account's context, not as a delegated administrator with its own management scope.

Practice this question →

297

MCQmedium

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

A.Use AWS Organizations service control policies to deny cross-account access.

B.Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.

C.Use AWS Trusted Advisor to check for unused cross-account roles.

D.Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

AnswerB

Access Analyzer automatically discovers cross-account access and can be centrally managed.

Why this answer

AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Exam trap

The trap here is that candidates confuse preventive controls (SCPs) with detective/audit controls, or they assume CloudTrail logging alone provides centralized auditing without considering the need for a purpose-built tool like IAM Access Analyzer to identify cross-account access configurations.

How to eliminate wrong answers

Option A is wrong because service control policies (SCPs) can deny or restrict permissions but do not provide auditing or centralized management of existing cross-account roles; they are preventive, not detective. Option C is wrong because AWS Trusted Advisor checks for unused IAM roles but does not specifically audit cross-account access or provide centralized management across multiple accounts. Option D is wrong because while CloudTrail logs AssumeRole events and Athena can query them, this approach requires aggregating logs from all accounts and does not offer a built-in, centralized auditing mechanism for cross-account roles like IAM Access Analyzer does.

Practice this question →

298

MCQhard

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

A.Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.

B.Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.

C.Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.

D.Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.

AnswerB

SCPs can centrally enforce encryption requirements across all accounts.

Why this answer

A service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config or default encryption, overlooking that SCPs can proactively deny API actions based on request parameters, which is the only way to enforce encryption without touching individual bucket policies.

How to eliminate wrong answers

Option A is wrong because S3 default encryption only applies to new objects written to a bucket, but it does not prevent users from overriding the encryption setting in a PutObject request or from modifying the bucket policy to disable encryption enforcement. Option C is wrong because AWS Config rules with Lambda remediation are reactive (detect and fix after the fact) and do not prevent non-compliant actions from occurring, which violates the requirement to enforce without modifying bucket policies. Option D is wrong because it requires modifying each account's bucket policy, which contradicts the requirement to apply the policy without modifying individual bucket policies.

Practice this question →

299

MCQmedium

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

A.Create VPC peering connections between all VPCs and enable the 'Allow DNS resolution from peered VPC' option.

B.Use Route 53 Resolver outbound endpoints and forwarding rules to forward DNS queries to the appropriate private hosted zones.

C.Configure Route 53 Resolver inbound endpoints in each VPC and set up conditional forwarding.

D.Associate each private hosted zone with each VPC using Route 53.

AnswerB

Resolver endpoints and forwarding rules enable cross-VPC DNS resolution.

Why this answer

Route 53 Resolver outbound endpoints allow you to forward DNS queries from your VPCs to custom DNS resolvers or to other private hosted zones. By creating outbound endpoints and forwarding rules, you can centrally route DNS queries from any VPC to the appropriate private hosted zone associated with another VPC, enabling cross-VPC DNS resolution without requiring VPC peering or complex associations.

Exam trap

The trap here is that candidates often confuse VPC peering DNS options with private hosted zone resolution, assuming that enabling 'Allow DNS resolution from peered VPC' automatically resolves private hosted zones across peers, when in fact it only affects the default VPC DNS server (AmazonProvidedDNS) and not custom private hosted zones.

How to eliminate wrong answers

Option A is wrong because VPC peering connections with 'Allow DNS resolution from peered VPC' only enable DNS resolution for the default VPC DNS server (the Amazon-provided DNS), not for private hosted zones associated with the peered VPC; private hosted zones require explicit association or forwarding rules. Option C is wrong because Route 53 Resolver inbound endpoints are used to receive DNS queries from on-premises networks or other resolvers, not to forward queries to private hosted zones within AWS; conditional forwarding is a client-side concept, not a resolver endpoint feature. Option D is wrong because associating each private hosted zone with each VPC is not scalable and does not solve the problem of resolving DNS names from one VPC's private hosted zone when the query originates from another VPC; private hosted zones are only resolvable from VPCs they are explicitly associated with, and this option does not provide a central resolution mechanism.

Practice this question →

300

MCQeasy

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

A.Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.

B.Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

C.Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

D.Have each account purchase its own Reserved Instances based on its usage.

AnswerA

Reserved Instances are shared across all accounts in the consolidated billing family.

Why this answer

AWS Organizations with consolidated billing allows Reserved Instance (RI) discounts to be applied across all accounts in the organization. By purchasing RIs in the management account, the finance team can centrally manage and optimize RI purchases, and the hourly cost and usage benefits are shared across all accounts, maximizing utilization and cost savings.

Exam trap

The trap here is that candidates may think each account must manage its own RIs (Option D) or that AWS Budgets can facilitate cross-account RI sharing (Option B), missing the key concept that consolidated billing enables centralized RI management and discount sharing.

How to eliminate wrong answers

Option B is wrong because AWS Budgets only monitors usage and costs; it does not enable cross-account RI sharing or central management. Option C is wrong because the EC2 Reserved Instance Marketplace is for selling unused RIs to third parties, not for distributing RIs across accounts within an organization. Option D is wrong because having each account purchase its own RIs prevents centralized optimization, leading to potential underutilization and missed savings from aggregated usage across accounts.

Practice this question →