Design Solutions for Organizational Complexity — AWS Certified Solutions Architect SAP-C02 practice questions

AWS Transit Gateway is BEST used for:

1. A managed content delivery network with edge caching and signed URLs for object access
2. A hybrid file service exposing S3-backed shares to on-premises NFS or SMB clients
3. Central hub-and-spoke connectivity for many VPCs and on-premises networks at scale
4. A replacement for AWS Identity and Access Management within multi-account Organizations

Answer: C — Central hub-and-spoke connectivity for many VPCs and on-premises networks at scale

C) TGW is a hub-and-spoke network transit service. A) That is CloudFront. B) That is Storage Gateway. D) TGW does not replace IAM.

An enterprise runs on-prem AD and is acquiring a company on Okta; both must federate to AWS via a single Identity Center instance. Which approach is BEST?

1. Configure Identity Center with AWS Managed Microsoft AD trusted to on-prem AD and add Okta as a second external identity source
2. Federate on-prem AD through Identity Center while bypassing it entirely for Okta users via direct per-account SAML
3. Pick either AD or Okta and manually provision IAM users for the other side rather than federating both organizations
4. Pick one external identity source per Identity Center instance and federate the second organization into it via SAML during integration

Answer: D — Pick one external identity source per Identity Center instance and federate the second organization into it via SAML during integration

D) Identity Center allows only one external identity source per instance; pick one and federate the other. A) Two external sources are not supported simultaneously. B) Bypassing Identity Center for Okta forfeits central federation. C) Manual IAM users defeat federation.

A firm managing 100+ AWS accounts needs uniform guardrails, centralized logging, and enterprise SSO. Which combination BEST meets all three?

1. AWS Organizations with Control Tower guardrails, IAM Identity Center, and a dedicated Log Archive account
2. AWS Organizations with per-account IAM users, individually configured CloudTrail, and local audit logs
3. A single shared AWS account with strict IAM policies, tag-based isolation, and one CloudTrail trail
4. Multiple independent AWS Organizations federated through a shared SAML identity provider

Answer: A — AWS Organizations with Control Tower guardrails, IAM Identity Center, and a dedicated Log Archive account

A) Control Tower provisions Landing Zone guardrails, Identity Center centralizes SSO, and a Log Archive account aggregates CloudTrail. B) Per-account IAM users scale poorly and duplicate logs. C) A single account fails isolation and blast-radius requirements. D) Multiple Organizations fragment billing and governance.

Sandbox accounts must allow arbitrary EC2 launches but stop all provisioning once a $500 monthly spend is breached, automatically. Which is BEST?

1. An SCP that denies ec2:RunInstances unconditionally after 72 hours of account life to bound spend indirectly
2. A daily Lambda function that queries Cost Explorer and revokes Identity Center permission sets per account manually
3. Tag-based billing plus a CloudWatch alarm that emails the developer team when spend exceeds the monthly threshold
4. AWS Budgets with Budget Action attaching a deny IAM policy to all roles on threshold breach plus Cost Anomaly Detection

Answer: D — AWS Budgets with Budget Action attaching a deny IAM policy to all roles on threshold breach plus Cost Anomaly Detection

D) Budget Actions are purpose-built to attach a deny policy on breach. A) Time-based deny does not reflect spend. B) Custom and slow. C) Email alerts are detective-only.

A security team wants ML-based threat detection aggregated across every account in the Organization. Which is BEST?

1. AWS WAF web ACLs configured on every ALB as the sole threat-detection layer
2. AWS Config rules alone streaming findings to a shared Amazon SNS topic
3. Amazon GuardDuty enabled Organization-wide with a delegated administrator account
4. Amazon Inspector scans of EC2 AMIs as the primary account-wide threat-detection service

Answer: C — Amazon GuardDuty enabled Organization-wide with a delegated administrator account

C) GuardDuty with a delegated admin is the Organization-wide threat detection service. A) WAF only inspects web traffic. B) Config detects configuration state, not threats. D) Inspector scans vulnerabilities, not runtime threats.

Cross-account access in AWS is BEST implemented via:

1. IAM roles with trust policies allowing principals in another account to assume via STS
2. Hardcoded API keys committed into Git repositories used by CI/CD pipelines across accounts
3. Root credentials shared through a corporate password manager and rotated once per quarter
4. Email-based authentication verifying the requester before console access is granted

Answer: A — IAM roles with trust policies allowing principals in another account to assume via STS

A) IAM cross-account roles + STS assume-role is the canonical pattern. B) Hardcoded keys are the anti-pattern. C) Shared root is the anti-pattern. D) Email is not an AWS auth mechanism.

Organizational Units (OUs) purpose?

Logical groupings of accounts. Apply policies hierarchically.

AWS Config conformance packs?

Bundle of rules for compliance frameworks (HIPAA, PCI, etc.). Deploy across org.

VPC Endpoints types?

Gateway (S3, DynamoDB) and Interface (most other AWS services, uses ENI).

Tag policies in Organizations?

Standardize tagging across accounts. Enforce required tags.