A company is setting up a new AWS Organizations structure with separate OUs for production and development workloads. The security team wants to ensure that no IAM principal in any account can disable AWS CloudTrail or delete existing CloudTrail trails. Which solution should the security team implement?

Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and attach it to the root OU.

Enable AWS CloudTrail in the management account and configure it to log trails from all member accounts.

Create an IAM policy that denies cloudtrail:DeleteTrail and attach it to all IAM users in every account.

Use AWS Config managed rule cloudtrail-enabled to automatically re-enable any trail that is deleted.

A solutions architect is designing a multi-account AWS environment for a large enterprise. The organization needs to group accounts that have similar security and compliance requirements so that governance policies can be applied consistently. Which AWS feature should be used to group these accounts?

Service control policies (SCPs)

An organization wants to ensure that no IAM principal in any account within a specific OU can access Amazon S3 buckets that are not tagged with a specific environment tag. Which AWS feature should be used to enforce this restriction?

Resource-based policy on the S3 bucket

A company is subject to a regulatory requirement that mandates all S3 buckets in the organization must be encrypted. The security team wants to enforce this requirement across all accounts. They also want to be alerted if any bucket is found to be non-compliant. Which solution should the security team implement?

Use AWS Trusted Advisor to check for S3 bucket encryption and send a weekly report.

Create an IAM policy that requires S3 bucket encryption and attach it to all IAM users.

Create an AWS Config rule that checks for S3 bucket encryption and set up an Amazon EventBridge rule to send alerts.

Create an SCP that denies the s3:PutBucketPolicy action unless the bucket has encryption enabled, and use AWS Config to detect and alert on non-compliant buckets.

AWSCertified Solutions Architect - Professional

Domain 1Objective 4

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 3)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

10concepts

10 Concepts in This Objective

Multi-account strategy
AWS Organizations
Service control policies (SCPs)
Account design patterns
Networking across accounts
Identity and access management (IAM) across accounts
Centralized logging and monitoring
Cost management and billing
Compliance and governance
Migration and account consolidation

Questions 11–15

11foundation · easy
A company wants to centrally manage multiple AWS accounts and consolidate billing. Which AWS service provides these capabilities natively?
Select an answer first
12application · medium
A company is setting up a new AWS Organizations structure with separate OUs for production and development workloads. The security team wants to ensure that no IAM principal in any account can disable AWS CloudTrail or delete existing CloudTrail trails. Which solution should the security team implement?
Select an answer first
13foundation · easy
A solutions architect is designing a multi-account AWS environment for a large enterprise. The organization needs to group accounts that have similar security and compliance requirements so that governance policies can be applied consistently. Which AWS feature should be used to group these accounts?
Select an answer first
14foundation · easy
An organization wants to ensure that no IAM principal in any account within a specific OU can access Amazon S3 buckets that are not tagged with a specific environment tag. Which AWS feature should be used to enforce this restriction?
Select an answer first
15expert · hard
A company is subject to a regulatory requirement that mandates all S3 buckets in the organization must be encrypted. The security team wants to enforce this requirement across all accounts. They also want to be alerted if any bucket is found to be non-compliant. Which solution should the security team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.4: Design a Multi-Account AWS Environment. SAP-C02 Practice Questions (Page 3)

Questions 11–15

A company wants to centrally manage multiple AWS accounts and consolidate billing. Which AWS service provides these capabilities natively?

An organization wants to ensure that no IAM principal in any account within a specific OU can access Amazon S3 buckets that are not tagged with a specific environment tag. Which AWS feature should be used to enforce this restriction?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity