Design a multi-account AWS environment.
21 practice questions under this official exam objective (SAP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
21 total · page 1 of 2How to Let a New Account Update AWS Config Under Root SCPs?
AWS Organizations SCPs at the root override lower-level allows, so a newly acquired account cannot update AWS Config until the root deny-list SCP is r
How to Share VPC Subnets Across AWS Accounts with RAM?
Sharing a common VPC network across many AWS accounts requires enabling AWS RAM resource sharing in Organizations and sharing the infrastructure accou
Centralized billing and service governance for LOB accounts with Organizations and SCPs
A parent with multiple LOB accounts needs a single consolidated invoice with per-account cost breakdown, service restrictions per governance, and full
Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket p
Data scientists run EC2 instances in public subnets of a VPC in a different AWS account from the S3 data lake, and their instances already have a role
Split a central Cost and Usage Report per account with an S3 event and Lambda
Each business unit account administrator must query only their own cost and utilization data through Athena. A consolidated organization-wide Cost and
Share a Transit Gateway through AWS RAM for cross-account Aurora connectivity
Development teams in separate member accounts need live connectivity to a single Amazon Aurora DB cluster hosted in a shared services account. Because
Restrict Amazon WorkSpaces access with an IP access control group
Thin client WorkSpaces must reach clinical trial applications only from company branch office locations, and a new branch office is planned within six
Expose a shared NLB through a VPC endpoint service when CIDR blocks overlap
A centralized EC2 application sits in a shared VPC behind a Network Load Balancer and up to ten business unit VPCs need to reach it. Some business uni
Combine S3 Multi-Region Access Points with Direct Connect and PrivateLink
A global static content platform is served from a single S3 bucket, uploaded from on-premises through an S3 File Gateway, and must serve customers fro
Enable AWS Security Hub across the organization with a delegated administrator
A company has created an AWS Control Tower landing zone and its security team will deploy preventive and detective controls across all accounts in the
Enable private DNS on the VPC so interface endpoint hostnames resolve to private addresses
A policy requires all internal application connectivity to use private IP addresses, so interface endpoints were created for AWS public services. Test
Share a Transit Gateway with AWS RAM for a self-service cross-account connection
A development account needs access to applications in a shared services VPC that is attached to a transit gateway. Resources in the development accoun
Deploying a CloudFormation StackSet with a custom-named IAM role to new Regions
A StackSet deployment to previously unused Regions fails to create stack instances when its template contains a custom-named IAM role. Two independent
Deny IAM actions for non-administrators with a service control policy at the root
A company manages many accounts with AWS Organizations and must ensure that only administrator roles are allowed to perform IAM actions. The architect
Enforce MFA on S3 CLI access with STS temporary credentials
Cloud engineers must upload objects to an S3 bucket using the AWS CLI with their own IAM user access keys, and every S3 action must require MFA. Each
Use VPC endpoints for S3 and Systems Manager plus VPC peering to the patch source
A company patches EC2 instances today through a NAT gateway to the internet and wants to switch to Systems Manager Patch Manager using a patch source
Use an organization CloudTrail trail in the management account instead of per-account trai
A company is planning a migration to AWS Cloud and will use multiple accounts managed in an AWS Organization, creating a few accounts at first and add
Peer each application VPC directly to the single target VPC in the other Region
A US company runs a microservices application across five VPCs in us-east-2 and must reach exactly one VPC in eu-west-1 with no access to any other VP
Aggregate organisation audit activity in CloudTrail Lake and query it with SQL
A company has multiple AWS accounts inside an AWS Organization and needs to store account activity in a central location and query that data using SQL
Publish the environment as a Service Catalog product with a launch constraint
A QA department needs to launch many short-lived test environments from an existing CloudFormation template, currently done by one manager using a rol