Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 16

Question 150

A multinational platform team wants to centrally enforce an SCP that blocks dangerous administrative API actions in production OUs while sandbox OUs remain less restricted. A workload developer claims a local administrator policy can override the production deny. What is the correct interpretation?

Attach an allow-all SCP to a production child OU and expect it to reverse an explicit Deny at a parent OU.
An applicable explicit SCP deny at a parent or target OU continues to cap the member-account principal despite local administrator identity allows.
Local AdministratorAccess always overrides inherited AWS Organizations explicit denies.
Grant the production role an administrator IAM identity policy and assume its allow overrides the Organizations SCP.

Explanation

Correct Answer

SCPs define maximum available permissions for supported principals in member accounts; local allows cannot override inherited explicit denies.

Incorrect Answers

Allow statements in a descendant policy cannot override an inherited explicit Deny.

An IAM identity allow cannot override an applicable organizational SCP deny.

Local identity allows are capped by an applicable explicit SCP deny, even for an administrator.

Question 151

A company requires central CloudTrail organization management events to be delivered to a separate log archive account with an independent KMS key and controlled deletion. Several new accounts were added yesterday. Which design property helps capture their activity?

Use a correctly configured organization trail managed from an authorized account and centralized archive bucket/key policies for current and new organization members.
Enable only Event History in the management account and assume it includes all new member data events.
Use a standard management-event CloudTrail trail in only the central log account without enabling the organization-trail setting.
Place audit logs only in local member buckets that local administrators can permanently delete.

Explanation

Correct Answer

Organization trails can cover member account activity without creating a separate trail manually for every joined account.

Incorrect Answers

Management-account event history is not a centralized long-term organization trail or selective member data-event program.

A local account trail cannot automatically include newly added member-account management events without organization-trail configuration.

Workload-account-only retention defeats the required independent log archive.

Question 152

A central AWS Config aggregator already receives complete configuration records from 90 Organization member accounts in four Regions. Audit requests a current inventory query listing EC2 instances with a specified type and S3 buckets where versioning is disabled, grouped by account and Region, without writing one Describe API client for every resource type. Which existing AWS Config feature should the team use?

Use AWS Config Advanced Query against the organization aggregator to select supported current resource configuration attributes across accounts and Regions.
Query Cost Explorer resource tags from the payer account and assume those tag totals expose full current Config resource-property inventory.
Run CloudTrail event history and assume it returns a complete, up-to-date inventory of all current EC2 and S3 resource properties.
Use Resource Explorer without any Config data and assume it provides full SQL-like AWS Config property filtering and aggregation for all resource types.

Explanation

Correct Answer

Advanced Query can search supported current AWS Config resource metadata through an aggregator with a constrained SQL SELECT dialect.

Incorrect Answers

Billing tags and totals lack the full current per-account resource configuration attributes and SQL-like Config Advanced Query semantics.

CloudTrail tracks API events, not a complete current-state SQL inventory of resource property values across services.

Resource Explorer has a separate search model and does not replace the stated Config Advanced Query interface for current configuration attributes.

Question 153

A company has several software vendors who license installed software differently across accounts. Licensing administrators need a common record of license entitlements and consumption while distributing controlled license configurations to member accounts. Which service belongs in the landing-zone plan?

Use AWS Config aggregated license-related instance metadata as the sole license entitlement and enforcement ledger.
Apply AWS Organizations tag policies to label licensed applications, expecting tags alone to track BYOL entitlements and consumption.
Use AWS License Manager with appropriate organization sharing and centrally governed license configurations.
Publish one Service Catalog licensed product and assume that product creation automatically tracks all third-party software installed across unmanaged member accounts.

Explanation

Correct Answer

License Manager can coordinate license constraints and usage tracking across accounts when supported integrations and sharing are set.

Incorrect Answers

Config can observe some resource properties but does not maintain purchased entitlements and License Manager usage governance.

Tags identify resources but do not supply the License Manager entitlement, consumption and license configuration model.

Service Catalog controls approved provisioning products; it is not the enterprise license consumption and entitlement register.

Question 154

A central directory team wants several application accounts to authenticate against the same managed Microsoft Active Directory, while avoiding an unrelated directory deployment in every account. Which AWS integration should it assess?

Create a separate AWS Managed Microsoft AD directory in every participant account and configure one-way trusts between all of them.
Export directory configuration from the owner and import new self-managed AD Domain Controllers into each participating VPC.
Share a supported AWS Managed Microsoft AD directory with authorized accounts using the directory-sharing workflow and required networking.
Associate participant VPCs with the owner’s Route 53 private hosted zone alone, without directory sharing authorization or DNS/network integration.

Explanation

Correct Answer

Directory sharing can allow account-separated workloads to use a centrally managed AD without duplicating the directory in every account.

Incorrect Answers

Independent per-account directories create extra management and do not meet the requirement to share one centrally owned managed directory.

Replicating directory configurations or DC fleets contradicts using one managed AD directory through AWS Directory Service sharing.

Private DNS association may help discovery but does not establish shared managed directory access or required account permissions.

Question 155

An organization has accounts in a sensitive OU that may use approved AWS Regions only. Security wants to apply a Region-deny SCP while preserving necessary global services and avoiding unintentional lockout of account administration. What is the right design process?

Use an AWS Organizations tag policy to limit approved Regions without an aws:RequestedRegion authorization condition.
Create a tested aws:RequestedRegion SCP policy with explicit, documented exceptions for required global service endpoints and recovery operations.
Deny every API in every Region with no exceptions and depend on emergency root use to bypass the policy.
Apply a deny on every global-service API endpoint with no supported exception and assume all emergency account recovery paths remain usable.

Explanation

Correct Answer

Region-deny guardrails need global-service and emergency-access consideration; untested blanket denies can break legitimate administration.

Incorrect Answers

Tag policies validate supported tag metadata; they do not implement preventive regional API denial.

Root identities in member accounts are also subject to applicable SCP limits and broad denies may cause lockout.

Blanket global-endpoint denial can break essential global control-plane and recovery operations; the guardrail needs documented exceptions.

Question 156

A company already uses Control Tower and Account Factory for Terraform to provision new AWS accounts through Git. Security now needs approved CloudFormation templates and organization policies rolled out to designated OUs whenever the landing-zone baseline changes, and newly created accounts must receive the same deployed resources automatically. The requirement is for CloudFormation/SCP customization, not a Terraform account request pipeline. Which solution fits?

Use only AFT account request Git files to push CloudFormation StackSets and SCPs into every OU without a supported customizations pipeline.
Use Customizations for AWS Control Tower (CfCT) with a reviewed manifest targeting the appropriate accounts/OUs, CloudFormation stacks and supported organization policies.
Keep the Account Factory Terraform request file unchanged and assume every arbitrary CloudFormation/SCP customization is automatically deployed with no customization pipeline.
Create a separate CodePipeline per individual account with manually copied policies, bypassing supported OU-targeted Control Tower lifecycle events.

Explanation

Correct Answer

CfCT deploys CloudFormation-based landing-zone customizations and organization policies to targeted OUs/accounts and responds to Control Tower lifecycle events.

Incorrect Answers

AFT provisions and customizes accounts through Terraform workflow, while the requested governed OU CloudFormation/SCP rollout is CfCT.

Account vending and baseline customization are separate workflows; an account request alone cannot enforce unspecified resource and SCP deployments.

Hand-maintained pipelines can deploy resources but do not provide CfCT’s centralized approved manifest and automatic OU account lifecycle behavior.

Question 157

A company centrally manages RDS backups in separate accounts but requires a governance view that compares multiple AWS Config managed rules as one standard across OUs. What reusable compliance construct should be deployed?

Use AWS Config conformance packs with organization deployment where supported, and collect source account compliance results centrally.
Use individual AWS Config managed rules in one security account and assume they automatically evaluate resources in all member accounts.
Use AWS Security Hub cross-Region finding aggregation alone as a replacement for centrally deploying the required AWS Config rule bundle.
Use CloudFormation StackSets to deploy one tag policy only and claim that it automatically evaluates encryption and backup conformance.

Explanation

Correct Answer

Conformance packs group rules and remediations into a reusable compliance framework that can be deployed across organizational targets.

Incorrect Answers

Account-local rules do not replace organization-scoped conformance pack deployment and evaluation in member accounts.

Finding aggregation provides visibility but does not deploy multiple configured Config rules as a reusable conformance pack.

Infrastructure deployment alone does not create the specified grouped resource-compliance rule and scoring construct.

Question 158

A large organization wants to keep emergency responders out of the management account while still allowing one authorized security member to manage organization-level AWS Backup policies. Which trust boundary should it verify?

Register the security account as an AWS Backup delegated administrator but leave AWS Organizations backup-policy delegation and member IAM administration permissions unconfigured.
Enable AWS Backup trusted access, register the security account as a Backup delegated administrator, grant its designated role AWSBackupOrganizationAdminAccess, and configure an AWS Organizations resource-based delegation policy allowing that member to manage backup policies.
Grant a security-member role the AWSBackupOrganizationAdminAccess IAM policy but do not delegate Organizations backup policies or register the member as AWS Backup delegated administrator.
Create a backup plan in the security account and share its recovery points without assigning an Organizations resource-based policy to manage organization-wide backup policy documents.

Explanation

Correct Answer

Backup delegated administration alone does not permit Organizations backup-policy management. The management account must explicitly delegate this policy management by an AWS Organizations resource-based policy, while the member administrator also has supported Backup org permissions and trusted access.

Incorrect Answers

Backup service delegated administration enables some organizational monitoring, but it alone does not grant authority to view or change AWS Organizations backup policies.

An IAM policy in a member account does not create the independent Organizations resource-based backup-policy delegation and necessary service administration relationship.

Sharing recovery points and local backup plans does not authorize member-account administration of AWS Organizations backup policies.

Question 159

An organization uses consolidated billing with dozens of member accounts. Finance must attribute shared application costs by product team using tags and perform detailed month-end analysis of resource usage. What should the architect implement?

Use AWS Cost Categories based only on account IDs while omitting the team tags needed to distinguish shared workloads in a member account.
Apply uniform team tags to resources but leave them inactive in the billing system while relying exclusively on EC2 inventory for historical cost.
Enable AWS Budgets by team but use each budget alert as the detailed source of billable resource-hours and monthly attribution.
Apply and activate a consistent cost-allocation tag, enforce tagging governance, and analyze the cost and usage report using the activated tag.

Explanation

Correct Answer

Activated cost-allocation tags appear in billing analytics including the Cost and Usage Report; consistent tagging and governance allow analysis by accountable team.

Incorrect Answers

Account-level categories cannot divide shared resources by product team when multiple teams use the same account; activated allocation tags provide that dimension.

The tag values must be activated for billing allocation to flow to supported cost-and-usage data. Resource inventory alone is not a billed line-item dataset.

Budget thresholds can warn about costs but do not replace the detailed line-item CUR and activated allocation tag analysis.

Question 160

Product costs span multiple linked accounts and shared platform resources. The finance team needs to report expenses using business product categories that combine multiple cost allocation tags and account groups. Which billing tool most directly builds those categories?

Create individual AWS Budgets scoped to each payer-linked account and use their alert amounts as the multi-dimensional product ledger.
Use AWS Cost Categories with rules combining relevant account, service and activated cost allocation tag dimensions.
Activate one product cost-allocation tag and report only those tagged resources, excluding charges from shared accounts that need business allocation.
Use Cost Explorer grouping by service and linked account each month, but rebuild product ownership manually in spreadsheets instead of defining reusable rules.

Explanation

Correct Answer

Cost Categories create business-oriented groupings across billing dimensions for allocation and analysis while preserving centralized reporting.

Incorrect Answers

Budgets can detect and forecast spend, but they do not implement the requested rules that combine accounts, services, tags and shared-platform categories.

A single tag can track direct spend but does not supply the composite classification and allocation rules for shared product costs described in the question.

Grouping is useful for ad hoc analysis, yet it does not centrally codify the repeatable business product categories requested across shared resources and accounts.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 150

Explanation

Correct Answer

Incorrect Answers

Question 151

Explanation

Correct Answer

Incorrect Answers

Question 152

Explanation

Correct Answer

Incorrect Answers

Question 153

Explanation

Correct Answer

Incorrect Answers

Question 154

Explanation

Correct Answer

Incorrect Answers

Question 155

Explanation

Correct Answer

Incorrect Answers

Question 156

Explanation

Correct Answer

Incorrect Answers

Question 157

Explanation

Correct Answer

Incorrect Answers

Question 158

Explanation

Correct Answer

Incorrect Answers

Question 159

Explanation

Correct Answer

Incorrect Answers

Question 160

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests