Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 15

Question 140

An organization deployed VPC IPAM and approved a private IPv4 pool. Some new VPC deployments still choose arbitrary blocks outside that pool because creation scripts permit manual CIDR entry. What guardrail best reduces recurrence?

Use Security Hub findings alone and allow every pipeline to keep choosing the same network range without a provisioning rule.
Constrain approved IaC/account provisioning to allocate new VPC CIDRs from the governed IPAM pool, and audit exceptions for manually assigned addresses.
Disable IPAM usage reporting so it cannot reveal VPCs created outside the approved address pool.
Enable IPAM compliance dashboards but continue permitting unvalidated manual CIDR creation in the same deployment pipeline.

Explanation

Correct Answer

An inventory is not enough if provisioning bypasses it; controlled allocation prevents new overlaps and records accountable exceptions.

Incorrect Answers

Postdeployment findings cannot substitute for preventive address-space allocation in the VPC provisioning path.

Removing visibility cannot enforce governed address allocation or eliminate overlapping CIDRs.

Post-creation monitoring may expose noncompliant CIDRs but does not prevent the source IaC path from selecting addresses outside the approved pool.

Question 141

A regulated organization has governed production and sandbox OUs. A security service delegated administrator needs permission to manage member enrollments without daily use of the AWS Organizations management account. What governance model should be established?

Register the supported member as the designated service delegated administrator and explicitly configure organization integration for that service.
Use ordinary IAM permission in the security member account without registering the delegated administrator with the integrated service.
Register all member accounts as service delegated administrators rather than designating one controlled security account.
Share AWS Config organization aggregation read access with the security account and assume that confers administration of unrelated service enrollments.

Explanation

Correct Answer

Delegated administration centralizes service operation in a designated member while keeping management-account access restricted.

Incorrect Answers

Account-local IAM grants alone cannot establish the service’s Organizations delegated administrator membership across the organization.

Unnecessary broad delegated administration contradicts the specified separation of duties and central accountable owner.

Read-only aggregation visibility is separate from that service’s delegated administrator authorization and trusted access.

Question 142

An AWS Organization wants an AWS Config organizational rule that evaluates a mandatory encryption control consistently across 75 member accounts. Some new accounts have no configuration recorder enabled. What prerequisite must the architect check?

Create an AWS Config organization aggregator without enabling configuration recording in its member accounts.
Deploy only a CloudFormation StackSet containing Config rule definitions but omit the configuration recorder and delivery roles in each new account.
Ensure AWS Config recording is enabled in relevant member accounts and Regions before relying on central organization evaluations.
Use CloudTrail management event collection in member accounts as an implicit replacement for AWS Config resource configuration snapshots.

Explanation

Correct Answer

An organization rule cannot evaluate missing resource configuration history from an account/Region without recording.

Incorrect Answers

An aggregator does not itself record missing member configurations needed by organizational rule evaluations.

Rule definitions cannot assess absent recorded resources; a member recording prerequisite remains.

CloudTrail API events are not the AWS Config current resource recording and compliance evaluation substrate.

Question 143

A platform team deploys baseline IAM roles and logging stacks to production OUs using CloudFormation StackSets. Newly created accounts are added to those OUs, but the team manually installs the same stack each time. Which StackSets feature simplifies onboarding?

Enable a self-managed StackSet but configure each new account’s execution role and deployment targets manually after it joins the OU.
Use service-managed permissions with organizational-unit targets and automatic deployment for accounts added to selected OUs.
Use CloudFormation stack exports from the management account and assume cross-account imports automatically instantiate new baseline resources.
Configure StackSet drift detection alone and assume detecting missing stacks automatically creates each baseline in new accounts.

Explanation

Correct Answer

StackSets auto-deployment can create approved stack instances as new accounts enter target OUs with supported trusted access.

Incorrect Answers

Self-managed roles and manual targeting can operate but do not provide the required automatic OU onboarding with service-managed permission handling.

Stack outputs and cross-stack imports do not perform StackSets organization deployment to newly enrolled member accounts.

Drift detection reports existing deployment differences; automatic provisioning requires service-managed auto-deployment targeting.

Question 144

An AWS Control Tower organization is on an older landing-zone version and needs a supported major-version upgrade before using newly approved landing-zone capabilities. More than 100 enrolled accounts span registered OUs, and the new version may require account updates after the landing-zone update. Which sequence is appropriate to maintain governance?

Update each member account to an arbitrary version first and leave the landing zone on the old release permanently.
Use the Control Tower drift Reset operation only; assume drift repair also upgrades every landing-zone version and enrolled account to the newest release.
Update the landing zone to the approved version, then update or re-register enrolled accounts/OUs according to current release and account procedures, verifying drift after rollout.
Run CloudFormation change-set preview for one workload stack and assume the Control Tower landing-zone service version is upgraded.

Explanation

Correct Answer

AWS documents landing-zone-first updating followed by individual or OU account re-registration where required, with release compatibility checks.

Incorrect Answers

Control Tower full update sequencing starts at the landing zone, followed by account updates as required for the release.

Reset addresses supported drift, while version upgrades require the documented landing-zone update and subsequent account update sequence.

A CloudFormation change set does not perform the managed landing-zone upgrade or synchronize registered organizational accounts.

Question 145

A company needs to distribute a curated set of approved CloudFormation-based products to development accounts while platform engineers own product versions and developers can provision only authorized options. Which AWS portfolio model is appropriate?

Share raw CloudFormation templates through S3 and let developers invoke CreateStack directly with unrestricted IAM roles.
Use AWS CloudFormation StackSets to push the entire fixed product catalog to every development account without any self-service product selection.
Create AWS Service Catalog portfolios and share approved products with relevant accounts or organization targets and scoped launch constraints.
Grant all developers unrestricted Service Catalog portfolio administration so they can change approved product templates and versions.

Explanation

Correct Answer

Service Catalog portfolios separate standardized infrastructure product governance from authorized self-service provisioning.

Incorrect Answers

Template distribution by itself does not provide curated product entitlements, versioned portfolios and controlled launch constraints.

Automatic StackSet deployments solve baseline rollout, not versioned developer-selected Service Catalog product entitlements.

Broad portfolio administrator access defeats the division between platform-owned product definitions and authorized provisioning.

Question 146

An organization already uses IAM Identity Center with external SAML sign-in and permission sets assigned to workforce groups. New employees authenticate at the identity provider, but their accounts and recent group changes do not appear automatically in the IAM Identity Center identity store, delaying account access. What synchronization mechanism should the platform team configure?

Create permanent IAM users in every AWS account and duplicate all directory groups manually whenever a worker joins or leaves.
Enable SCIM v2 automatic provisioning between the external IdP and IAM Identity Center, including the required IdP attribute mappings, endpoint, and protected provisioning token.
Create one new permission set for every login attempt without syncing the underlying user and group identities from the IdP.
Use SAML authentication assertion updates alone without enabling automated identity/group provisioning into IAM Identity Center.

Explanation

Correct Answer

IAM Identity Center supports SCIM-based user and group provisioning from an external identity provider, solving the missing identity-store lifecycle updates while existing account assignments remain in place.

Incorrect Answers

Per-account IAM users undermine centralized federation and do not synchronize user/group lifecycle updates with the external directory.

Permission sets grant permissions to existing identities and groups; they do not automatically provision absent people or synchronize memberships from an external directory.

SAML handles sign-in, but not automatic SCIM user and group lifecycle synchronization into the Identity Center identity store.

Question 147

An organization must apply standardized backup retention schedules to production accounts based on OU membership while keeping the individual accounts responsible for resource tagging. What AWS Organizations integration provides central backup policy management?

Create a tag policy defining Backup=true without deploying any backup plans or rules.
Configure AWS Organizations backup policies with the needed AWS Backup trusted access and target OU/account scope, then verify local backup coverage.
Configure AWS Config organizational rules to detect missed backups but assume they themselves define and execute the required AWS Backup retention plan.
Deploy separate manual AWS Backup plans in every account and Region with no organizational OU policy assignment.

Explanation

Correct Answer

Organization backup policies centrally define supported backup plans while individual resources still require correct selections and permissions.

Incorrect Answers

Tag syntax standards alone do not schedule backup jobs or establish retention.

Config rules are detective compliance assessments; the retention schedules require AWS Backup plans and Organizations backup policy integration.

Independent plans may perform backups but do not deliver the specified central OU membership-based policy management.

Question 148

A customer uses AWS Organizations and needs a centrally administered service that applies AWS WAF policies to supported ALBs and CloudFront distributions across accounts. New application accounts should receive policy coverage without individual manual setup. Which service is appropriate?

Create AWS Config rules only and assume detective compliance evaluations install WAF web ACL rules everywhere.
Deploy AWS WAF web ACLs through hand-maintained CloudFormation stacks in every account without organizational policy enforcement.
Enable Shield Advanced on one edge distribution and assume that automatically distributes approved application-layer WAF policies to all member-account ALBs.
Use AWS Firewall Manager with organizational integration, a delegated security administrator and policies targeting the relevant resources.

Explanation

Correct Answer

Firewall Manager can manage supported protection policies across organization members and automatically cover new eligible resources.

Incorrect Answers

Config evaluates posture but does not by itself create the required managed WAF deployment strategy.

Manual WAF distribution can protect individual resources but lacks Firewall Manager centralized OU targeting and drift enforcement.

DDoS subscription for one resource does not centrally govern WAF web ACL policies for every supported resource in all accounts.

Question 149

An enterprise centralizes AWS Health operational event monitoring across its accounts. The operations team wants to know which member accounts are affected by AWS service events without manually logging into each account. Which organization-wide feature helps?

Configure Route 53 health checks for member applications and use their DNS status as the complete AWS Health account-event inventory.
Configure CloudWatch cross-account observability alone and assume it imports every Health service-maintenance event and affected account.
Enable AWS Health organizational view with required Organizations integration and review account-specific affected entities.
Use EventBridge rules separately in each member account but never establish the consolidated AWS Health organizational view.

Explanation

Correct Answer

AWS Health organizational view aggregates supported operational event impacts across organization member accounts.

Incorrect Answers

Route 53 service endpoint health does not supply AWS Health organizational events and affected entities.

Metrics/logs observability sharing does not replace the AWS Health organization-event feed and affected-account context.

Per-account event routing can notify of selected events but does not directly meet the central cross-account view requirement.

Question 150

A multinational platform team wants to centrally enforce an SCP that blocks dangerous administrative API actions in production OUs while sandbox OUs remain less restricted. A workload developer claims a local administrator policy can override the production deny. What is the correct interpretation?

Attach an allow-all SCP to a production child OU and expect it to reverse an explicit Deny at a parent OU.
An applicable explicit SCP deny at a parent or target OU continues to cap the member-account principal despite local administrator identity allows.
Local AdministratorAccess always overrides inherited AWS Organizations explicit denies.
Grant the production role an administrator IAM identity policy and assume its allow overrides the Organizations SCP.

Explanation

Correct Answer

SCPs define maximum available permissions for supported principals in member accounts; local allows cannot override inherited explicit denies.

Incorrect Answers

Allow statements in a descendant policy cannot override an inherited explicit Deny.

An IAM identity allow cannot override an applicable organizational SCP deny.

Local identity allows are capped by an applicable explicit SCP deny, even for an administrator.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 140

Explanation

Correct Answer

Incorrect Answers

Question 141

Explanation

Correct Answer

Incorrect Answers

Question 142

Explanation

Correct Answer

Incorrect Answers

Question 143

Explanation

Correct Answer

Incorrect Answers

Question 144

Explanation

Correct Answer

Incorrect Answers

Question 145

Explanation

Correct Answer

Incorrect Answers

Question 146

Explanation

Correct Answer

Incorrect Answers

Question 147

Explanation

Correct Answer

Incorrect Answers

Question 148

Explanation

Correct Answer

Incorrect Answers

Question 149

Explanation

Correct Answer

Incorrect Answers

Question 150

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests