A company has multiple AWS accounts and wants to allow a user in one account to access an S3 bucket in another account. Which approach provides secure, temporary access while maintaining least privilege?

Share the access keys of the target account's root user

Use an S3 bucket policy to allow all users from the source account

Create an IAM role in the target account and allow the user to assume it

Create an IAM user in the target account with the same password

A company has a multi-account environment with hundreds of accounts. The security team needs to have a centralized view of security findings and compliance status across all accounts. They also want to be able to take corrective actions, such as remediating non-compliant resources, from a central location. Which solution should the security team implement?

Use AWS Security Hub in the management account and enable it for all accounts in the organization.

Use AWS CloudTrail to collect API activity logs from all accounts and store them in a central S3 bucket.

Use AWS Config aggregator in the management account to collect configuration data from all accounts.

Use AWS Trusted Advisor to check for security issues and send a weekly report.

AWSCertified Solutions Architect - Professional

Domain 1Objective 4

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 1)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

10concepts

10 Concepts in This Objective

Multi-account strategy
AWS Organizations
Service control policies (SCPs)
Account design patterns
Networking across accounts
Identity and access management (IAM) across accounts
Centralized logging and monitoring
Cost management and billing
Compliance and governance
Migration and account consolidation

Questions 1–5

1foundation · easy
A company has multiple AWS accounts and wants to allow a user in one account to access an S3 bucket in another account. Which approach provides secure, temporary access while maintaining least privilege?
Select an answer first
2foundation · easy
A company is designing a multi-account AWS environment and needs to separate accounts for different business units while maintaining centralized governance. Which AWS service provides the foundational structure for creating and managing multiple accounts with OUs and policies?
Select an answer first
3foundation · easy
An organization needs to allow a service in one VPC to securely access a service in another VPC without exposing the service to the public internet and without requiring the VPCs to be peered. Which AWS service should be used?
Select an answer first
4foundation · easy
A company has multiple VPCs across several AWS accounts and needs to establish network connectivity between them. The company wants to minimize the number of network connections and simplify routing. Which AWS service is designed to act as a central hub for interconnecting VPCs and on-premises networks?
Select an answer first
5expert · hard
A company has a multi-account environment with hundreds of accounts. The security team needs to have a centralized view of security findings and compliance status across all accounts. They also want to be able to take corrective actions, such as remediating non-compliant resources, from a central location. Which solution should the security team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 1)

Questions 1–5

A company has multiple AWS accounts and wants to allow a user in one account to access an S3 bucket in another account. Which approach provides secure, temporary access while maintaining least privilege?

A company is designing a multi-account AWS environment and needs to separate accounts for different business units while maintaining centralized governance. Which AWS service provides the foundational structure for creating and managing multiple accounts with OUs and policies?

An organization needs to allow a service in one VPC to securely access a service in another VPC without exposing the service to the public internet and without requiring the VPCs to be peered. Which AWS service should be used?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity