Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 14

Question 130

An enterprise uses AWS Organizations OUs for production and development. Security applies a common SCP at a parent OU and more restrictive SCPs to production. A developer says the production child policy should override a parent explicit Deny. What should the architect clarify?

Attach an account-level SCP allowing all AWS API actions and assume it cancels an inherited parent OU explicit Deny.
An explicit Deny inherited from a parent cannot be overridden by an Allow in a child; effective permission boundaries combine along the account path.
Child OU Allow statements automatically cancel parent Deny statements whenever their policy JSON is more recent.
Attach an AdministratorAccess IAM identity policy to the application role while retaining the parent OU explicit Deny.

Explanation

Correct Answer

SCP evaluation preserves explicit deny and requires applicable allows under the selected policy strategy across each relevant OU level.

Incorrect Answers

An account-level Allow cannot supersede an explicit Deny inherited anywhere along its AWS Organizations ancestry.

Explicit deny semantics are not superseded by newer allows in a lower-level organizational policy.

IAM grants are bounded by applicable SCP explicit denies; a broad IAM allow remains ineffective for the denied operation.

Question 131

A network platform account owns a central Transit Gateway. Workload accounts in the same Organization need to create attachments to it without receiving administrative control over the gateway route tables. Which resource-sharing construct should be used?

Share an IAM role in the network account that lets every participant edit the owner’s Transit Gateway route tables as a substitute for resource sharing.
Create an independent Transit Gateway in each workload account and peer it to the central gateway instead of sharing its attachment resource.
Create a VPC peering connection from every workload VPC to the network VPC, then rely on the network VPC for transitive TGW access.
Share the Transit Gateway resource using AWS Resource Access Manager and grant scoped participant attachment permissions.

Explanation

Correct Answer

RAM shares supported resources across member accounts while the owner retains management of the gateway and routing configuration.

Incorrect Answers

Cross-account IAM administration of the owner route tables would violate the requirement that routing configuration remain centrally owned.

Separate gateways and peering can create alternate connectivity but add unnecessary transit infrastructure and do not directly share the specified owner gateway.

VPC peering is nontransitive and does not grant the cross-account Transit Gateway attachment capability requested.

Question 132

A security account is already the GuardDuty delegated administrator for a 70-account AWS Organization. Foundational management-event and DNS threat detection works in the required Regions, but a response exercise shows that suspicious authenticated GetObject calls to sensitive S3 buckets are not producing the expected S3-specific findings. The company wants the added protection automatically enabled for both existing and incoming accounts. What should the delegated administrator configure?

Enable GuardDuty S3 Protection for all eligible organization accounts in each required Region using the organization-level protection-plan preferences.
Enable GuardDuty S3 Protection only in the delegated administrator account and assume S3 object activity in all members is monitored.
Turn on organization CloudTrail S3 data-event recording but leave the GuardDuty S3 Protection plan disabled in every member account.
Enable GuardDuty Malware Protection for S3 object uploads alone and assume that it replaces S3 data-event anomaly detection.

Explanation

Correct Answer

GuardDuty S3 Protection analyzes CloudTrail S3 data events and the delegated administrator can enable it for all existing and new member accounts in each supported Region.

Incorrect Answers

Enabling S3 Protection in only the administrator account does not automatically activate the required member-account S3 data-event protection in every Region.

CloudTrail data-event capture records object APIs for auditing but does not enable GuardDuty’s managed S3 behavior-based threat findings when the protection plan remains off.

Malware Protection for S3 scans eligible uploaded objects; it does not replace S3 Protection analysis of suspicious authenticated data API behavior.

Question 133

An enterprise is migrating to AWS Control Tower and already has dozens of accounts enrolled in Organizations. Security wants to verify whether selected enrolled accounts and OUs drifted from the landing-zone guardrails and apply supported repair operations. What should operators examine?

Use Control Tower governance/drift reporting and supported account or OU re-registration and update procedures.
Run AWS Config organization conformance-pack evaluations only and assume they replace Control Tower account and OU registration drift checks.
Use CloudFormation drift detection only on one application stack and assume it covers every governed Control Tower landing-zone baseline.
Re-apply Service Catalog products in each account without reviewing registered OU baseline versions or Control Tower drift status.

Explanation

Correct Answer

Landing-zone governance needs visibility of enrolled-resource drift and controlled repair rather than assuming initial setup remains permanently aligned.

Incorrect Answers

Config compliance reports can identify selected resource-policy issues, but do not independently reconcile Control Tower landing-zone account/OU registration state.

Individual stack drift analysis does not comprehensively evaluate the Control Tower landing-zone governance and enrollment state.

Service Catalog products do not by themselves confirm or reconcile AWS Control Tower governance drift.

Question 134

A large Organization needs a centrally delegated DNS service team to share conditional Route 53 Resolver rules across application VPCs owned by separate accounts. The teams are in the same Organization. Which mechanism enables controlled sharing?

Use AWS Resource Access Manager for supported Route 53 Resolver rule sharing and associate the shared rules with the intended VPCs.
Associate the private hosted zone with every participant VPC, but do not share any of the conditional forwarding rules to external resolvers.
Create separate outbound Resolver endpoints and duplicate forwarding rules in every VPC instead of sharing the centralized rule set.
Share the central outbound Resolver endpoint ENIs as if they were VPC subnet shares, rather than share its conditional forwarding rules.

Explanation

Correct Answer

RAM allows central owners to share applicable Resolver rules while participants control supported VPC associations under their permissions.

Incorrect Answers

Private hosted-zone association grants names hosted in Route 53; it does not distribute existing outbound Resolver rules for on-premises zones.

Duplicating endpoints and rules could build a more expensive independent design but does not meet the specific centrally delegated rule-sharing requirement.

Resolver endpoint network interfaces are not the supported account-level abstraction for sharing and associating forwarding rules.

Question 135

A multinational company has hundreds of VPCs across Organization accounts. The current method allocates IPv4 ranges manually, causing overlaps when teams propose new CIDRs. Which AWS capability should be used for centrally governed address allocation?

Aggregate AWS Config VPC resource configuration and allocate all new CIDRs manually in separate regional spreadsheets.
Use AWS Organizations tag policies to name IPv4 owners, and assume tag compliance prevents overlapping prefixes when new VPCs are created.
Use Amazon VPC IP Address Manager with managed pools and account/Region sharing appropriate to the organization.
Use Transit Gateway route propagation as the IPAM allocation ledger and assume gateways reserve every desired subnet before creation.

Explanation

Correct Answer

IPAM tracks and allocates address ranges from governed pools, reducing accidental overlap and enabling centralized network address governance.

Incorrect Answers

Config inventory can reveal existing network ranges but cannot provide centrally governed, conflict-aware pool allocations by itself.

Tag policy enforcement governs supported metadata values, not CIDR pool allocation uniqueness or detected overlap across VPCs.

Transit Gateway distributes network reachability to already provisioned address space; it does not allocate collision-free VPC CIDRs.

Question 136

A regulated company already operates a Control Tower landing zone and has a working console-based Account Factory. Platform engineering now requires an audited Terraform Git repository to submit new account requests, trigger governed account creation and apply account-level customizations without reimplementing the landing zone. Which AWS Control Tower integration should be deployed?

Use AWS Control Tower Account Factory for Terraform (AFT) and submit version-controlled Terraform account request files through its supported provisioning pipeline.
Keep manual console Account Factory requests and use Terraform only to create resources after the new accounts already exist.
Deploy CloudFormation StackSets to existing OUs, expecting StackSets to replace the Account Factory workflow that actually creates new member accounts.
Use standalone Terraform aws_organizations_account resources in an unrelated pipeline and skip the configured Control Tower AFT governance/customization workflow.

Explanation

Correct Answer

Account Factory for Terraform provides a GitOps account-request pipeline for Control Tower accounts while retaining governed account enrollment and customization.

Incorrect Answers

Post-provisioning Terraform alone does not make Git-based account requests initiate governed account creation.

StackSets distribute infrastructure into existing target accounts, but are not the account-request-driven Terraform vending integration.

Raw Organizations account provisioning alone does not supply the required Control Tower-integrated AFT pipeline and account customization lifecycle.

Question 137

A platform team wants a delegated security administrator to run an AWS Config aggregator that displays compliant and noncompliant resources across member accounts and Regions. They have created the aggregator but see no recent resource findings. What prerequisite should they verify?

Rebuild only the organization aggregator while leaving the missing member-account recorders disabled.
Enable central AWS Config delivery in the delegated account alone, without source member recording or aggregation permissions.
Create organization-wide AWS Config rules but leave all unrecorded resources unavailable to their source Config recorders.
Ensure member accounts and Regions have AWS Config recording and appropriate authorization to deliver configuration and compliance data to the aggregator.

Explanation

Correct Answer

Aggregation does not create source configuration data; recording and permissions must exist for each account and Region expected in the central view.

Incorrect Answers

The aggregator consumes configuration data; reinstalling it does not originate configuration or compliance results where recorders are absent.

A delegated account recorder covers its local resources and does not create data for other member accounts and Regions.

Organization rules need underlying recorded source configurations; rule definitions alone cannot evaluate resources never recorded in members.

Question 138

An Organization has several accounts with strict sandbox spending controls. Platform engineering wants to restrict permitted API actions by OU while finance wants spending alerts before thresholds are exceeded. Which distinction should the operating model maintain?

Use a Cost Category rule as the only preventive AWS API authorization control for the sandbox OU.
Use SCPs or service-specific authorization for preventive permissions and AWS Budgets for monitored spending thresholds.
Assume a budget alert email alone denies every EC2 RunInstances call after a dollar threshold without any explicit action integration.
Use only SCPs to calculate comprehensive amortized spending and line-item charges in the billing organization.

Explanation

Correct Answer

SCP boundaries can restrict principal actions; Budgets detect or notify financial threshold changes and are not blanket account authorization rules.

Incorrect Answers

Cost Categories classify billed usage; they do not enforce API authorization decisions or OU-level permission limits.

Budget notifications by themselves do not implement generalized IAM authorization denies on subsequent AWS API requests.

SCPs restrict authorization but do not produce detailed cost allocation, invoices or financial threshold accounting.

Question 139

An organization already uses VPC IP Address Manager pools to issue new VPC CIDRs. During acquisition integration, several older VPCs were imported from another account without IPAM-based allocations, and engineers suspect two CIDRs overlap. The architect needs an inventory-level diagnosis before approving new peering routes. Which IPAM view should be consulted?

Use the IPAM resource CIDR map or dashboard to identify overlapping, unmanaged and noncompliant allocations within the relevant scope before approving the routes.
Create a second IPAM instance and ignore the first instance’s existing monitored resources so both can allocate overlapping prefixes independently.
Allow VPC peering between the suspected overlapping CIDRs, trusting longest-prefix routing to resolve the address collision after acceptance.
Query VPC Flow Logs for address collisions, treating observed packet flows as the authoritative allocation inventory for imported VPCs.

Explanation

Correct Answer

IPAM’s monitored resource views expose overlapping CIDRs and allocations outside pool rules, enabling a specific pre-peering overlap investigation.

Incorrect Answers

Independent allocation scopes without reconciling existing address ownership can multiply collisions rather than discover and resolve the overlap.

Overlapping VPC CIDRs are not a safe route design, and peering cannot bypass the fundamental address-overlap restriction.

Flow Logs reveal actual network connections but do not enumerate unused VPC CIDRs or replace IPAM resource-level overlap/compliance monitoring.

Question 140

An organization deployed VPC IPAM and approved a private IPv4 pool. Some new VPC deployments still choose arbitrary blocks outside that pool because creation scripts permit manual CIDR entry. What guardrail best reduces recurrence?

Use Security Hub findings alone and allow every pipeline to keep choosing the same network range without a provisioning rule.
Constrain approved IaC/account provisioning to allocate new VPC CIDRs from the governed IPAM pool, and audit exceptions for manually assigned addresses.
Disable IPAM usage reporting so it cannot reveal VPCs created outside the approved address pool.
Enable IPAM compliance dashboards but continue permitting unvalidated manual CIDR creation in the same deployment pipeline.

Explanation

Correct Answer

An inventory is not enough if provisioning bypasses it; controlled allocation prevents new overlaps and records accountable exceptions.

Incorrect Answers

Postdeployment findings cannot substitute for preventive address-space allocation in the VPC provisioning path.

Removing visibility cannot enforce governed address allocation or eliminate overlapping CIDRs.

Post-creation monitoring may expose noncompliant CIDRs but does not prevent the source IaC path from selecting addresses outside the approved pool.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 130

Explanation

Correct Answer

Incorrect Answers

Question 131

Explanation

Correct Answer

Incorrect Answers

Question 132

Explanation

Correct Answer

Incorrect Answers

Question 133

Explanation

Correct Answer

Incorrect Answers

Question 134

Explanation

Correct Answer

Incorrect Answers

Question 135

Explanation

Correct Answer

Incorrect Answers

Question 136

Explanation

Correct Answer

Incorrect Answers

Question 137

Explanation

Correct Answer

Incorrect Answers

Question 138

Explanation

Correct Answer

Incorrect Answers

Question 139

Explanation

Correct Answer

Incorrect Answers

Question 140

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests