Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 1

 

Topic 02 Practice Test 1 covers Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A platform team in Account A must administer a small set of EC2 resources in Account B without creating long-lived IAM users in Account B. The team already authenticates in Account A. Which design best provides temporary cross-account access?

1. Cross-account IAM role with a trust policy
2. S3 bucket policy
3. AWS Organizations tag policy
4. IAM user in Account B with access keys

Correct Answer(s)

 

A

Rationale

1. Cross-account IAM role with a trust policy is trusted temporary identity delegation for STS, matching temporary credentials. It supports use a trusted cross-account IAM role plus sts AssumeRole permission for temporary EC2 administration. With administrators originate in Account A also required, Cross-account IAM role with a trust policy is the appropriate IAM role control.
2. S3 bucket policy is resource-side principal authorization for STS. The scenario requires avoid long-lived users, so this alternative is insufficient. Cross-account IAM role with a trust policy addresses temporary credentials within this cross-account scenario. By comparison, S3 bucket policy leaves administrators originate in Account A unresolved.
3. AWS Organizations tag policy is organization-wide tag standards for STS. The scenario requires temporary credentials, so this alternative is insufficient. Cross-account IAM role with a trust policy addresses administrators originate in Account A within this cross-account scenario. By comparison, AWS Organizations tag policy leaves avoid long-lived users unresolved.
4. IAM user in Account B with access keys is long-lived account credentials for STS. The scenario requires administrators originate in Account A, so this alternative is insufficient. Cross-account IAM role with a trust policy addresses avoid long-lived users within this cross-account scenario. By comparison, IAM user in Account B with access keys leaves temporary credentials unresolved.

 

Question 2

A SaaS vendor assumes a customer IAM role to collect cost data. Many customers use the same vendor AWS account, so the customer must reduce the confused-deputy risk. Which role-trust control is most appropriate?

1. Require the vendor’s source IP only
2. Attach an SCP that allows sts:AssumeRole
3. Require a unique sts:ExternalId condition
4. Enable consolidated billing

Correct Answer(s)

 

C

Rationale

1. Require the vendor’s source IP only is source-IP context filtering for role trust. The scenario requires confused-deputy protection, so this alternative is insufficient. Require a unique sts:ExternalId condition addresses third-party vendor within this third party scenario. By comparison, Require the vendor’s source IP only leaves shared vendor account unresolved.
2. Attach an SCP that allows sts:AssumeRole is organization-wide permission ceilings for role trust. The scenario requires third-party vendor, so this alternative is insufficient. Require a unique sts:ExternalId condition addresses shared vendor account within this third party scenario. By comparison, Attach an SCP that allows sts:AssumeRole leaves confused-deputy protection unresolved.
3. Require a unique sts:ExternalId condition is third-party role context binding for role trust, matching third-party vendor. It supports require a customer-specific ExternalId condition when a third party assumes the shared-vendor cross-account role. With shared vendor account also required, Require a unique sts:ExternalId condition is the appropriate ExternalId control.
4. Enable consolidated billing is organization billing aggregation for role trust. The scenario requires shared vendor account, so this alternative is insufficient. Require a unique sts:ExternalId condition addresses confused-deputy protection within this third party scenario. By comparison, Enable consolidated billing leaves third-party vendor unresolved.

 

Question 3

An analytics role in Account B needs read-only access to one S3 bucket in Account A. The data team wants to share only that bucket rather than let the role assume a broad role in Account A. Which mechanism should authorize the bucket?

1. Route table entry
2. Security group ingress rule
3. S3 bucket resource policy naming the Account B role
4. AWS Organizations service control policy

Correct Answer(s)

 

C

Rationale

1. Route table entry is VPC network path selection for resource policy. The scenario requires resource-level sharing, so this alternative is insufficient. S3 bucket resource policy naming the Account B role addresses one S3 bucket within this cross-account scenario. By comparison, Route table entry leaves external role unresolved.
2. Security group ingress rule is stateful network filtering for resource policy. The scenario requires one S3 bucket, so this alternative is insufficient. S3 bucket resource policy naming the Account B role addresses external role within this cross-account scenario. By comparison, Security group ingress rule leaves resource-level sharing unresolved.
3. S3 bucket resource policy naming the Account B role is resource-side principal authorization for resource policy, matching one S3 bucket. It supports grant the external analytics role direct bucket access with an S3 resource policy scoped to read operations. With external role also required, S3 bucket resource policy naming the Account B role is the appropriate S3 control.
4. AWS Organizations service control policy is organization-wide permission ceilings for resource policy. The scenario requires external role, so this alternative is insufficient. S3 bucket resource policy naming the Account B role addresses resource-level sharing within this cross-account scenario. By comparison, AWS Organizations service control policy leaves one S3 bucket unresolved.

 

Question 4

A role in Account B must decrypt objects encrypted with a customer managed KMS key in Account A. The role already has an IAM policy allowing kms:Decrypt on the key ARN. What additional authorization is required for cross-account KMS use?

1. Organizations tag policy
2. CloudTrail event data store
3. S3 ACL granting FULL_CONTROL
4. Key policy in Account A permitting the external account or role

Correct Answer(s)

 

D

Rationale

1. Organizations tag policy is organization-wide tag standards for key policy. The scenario requires IAM permission already exists, so this alternative is insufficient. Key policy in Account A permitting the external account or role addresses customer managed KMS key within this cross-account scenario. By comparison, Organizations tag policy leaves cross-account cryptographic use unresolved.
2. CloudTrail event data store is CloudTrail Lake event analytics for key policy. The scenario requires customer managed KMS key, so this alternative is insufficient. Key policy in Account A permitting the external account or role addresses cross-account cryptographic use within this cross-account scenario. By comparison, CloudTrail event data store leaves IAM permission already exists unresolved.
3. S3 ACL granting FULL_CONTROL is object-storage access control for key policy. The scenario requires cross-account cryptographic use, so this alternative is insufficient. Key policy in Account A permitting the external account or role addresses IAM permission already exists within this cross-account scenario. By comparison, S3 ACL granting FULL_CONTROL leaves customer managed KMS key unresolved.
4. Key policy in Account A permitting the external account or role is KMS key-use authorization for key policy, matching customer managed KMS key. It supports pair the external role IAM permission with a KMS key policy grant in the key-owning account. With cross-account cryptographic use also required, Key policy in Account A permitting the external account or role is the appropriate KMS control.

 

Question 5

A company owns hundreds of S3 buckets across member accounts. Bucket policies should allow a shared service only when the caller belongs to the company’s current AWS Organization, without listing every account ID. Which global condition key is designed for this?

1. aws:PrincipalOrgID
2. aws:RequestedRegion
3. aws:SourceVpc
4. aws:MultiFactorAuthAge

Correct Answer(s)

 

A

Rationale

1. aws:PrincipalOrgID is organization-membership policy filtering for resource policy, matching many member accounts. It supports restrict resource-policy access to principals from the current organization by testing aws PrincipalOrgID. With avoid account lists also required, aws:PrincipalOrgID is the appropriate PrincipalOrgID control.
2. aws:RequestedRegion is region-request context filtering for resource policy. The scenario requires organization membership boundary, so this alternative is insufficient. aws:PrincipalOrgID addresses many member accounts within this Organizations scenario. By comparison, aws:RequestedRegion leaves avoid account lists unresolved.
3. aws:SourceVpc is source-VPC context filtering for resource policy. The scenario requires many member accounts, so this alternative is insufficient. aws:PrincipalOrgID addresses avoid account lists within this Organizations scenario. By comparison, aws:SourceVpc leaves organization membership boundary unresolved.
4. aws:MultiFactorAuthAge is MFA-age context filtering for resource policy. The scenario requires avoid account lists, so this alternative is insufficient. aws:PrincipalOrgID addresses organization membership boundary within this Organizations scenario. By comparison, aws:MultiFactorAuthAge leaves many member accounts unresolved.

 

Question 6

A networking account owns subnets that application accounts in the same AWS Organization must use directly. Administrators want supported resource sharing that follows organization membership and avoids copying the subnets. Which service should they use?

1. AWS CloudFormation StackSets only
2. AWS Resource Access Manager (AWS RAM)
3. AWS Artifact
4. Amazon Inspector

Correct Answer(s)

 

B

Rationale

1. AWS CloudFormation StackSets only is multi-account infrastructure deployment for resource sharing. The scenario requires central network ownership, so this alternative is insufficient. AWS Resource Access Manager (AWS RAM) addresses same organization within this Organizations scenario. By comparison, AWS CloudFormation StackSets only leaves shared subnets unresolved.
2. AWS Resource Access Manager (AWS RAM) is managed cross-account resource sharing for resource sharing, matching same organization. It supports share supported network resources with organization accounts through AWS RAM instead of duplicating them. With shared subnets also required, AWS Resource Access Manager (AWS RAM) is the appropriate AWS RAM control.
3. AWS Artifact is compliance-report retrieval for resource sharing. The scenario requires same organization, so this alternative is insufficient. AWS Resource Access Manager (AWS RAM) addresses shared subnets within this Organizations scenario. By comparison, AWS Artifact leaves central network ownership unresolved.
4. Amazon Inspector is workload vulnerability assessment for resource sharing. The scenario requires shared subnets, so this alternative is insufficient. AWS Resource Access Manager (AWS RAM) addresses central network ownership within this Organizations scenario. By comparison, Amazon Inspector leaves same organization unresolved.

 

Question 7

Security architects need continuous findings when an S3 bucket policy, KMS key policy, or IAM role trust policy makes a protected resource reachable from outside the defined organization. Which service is purpose-built for this analysis?

1. IAM Access Analyzer
2. AWS Trusted Advisor only
3. Amazon CloudWatch Synthetics
4. AWS Cost Explorer

Correct Answer(s)

 

A

Rationale

1. IAM Access Analyzer is external-access policy analysis for external access, matching resource policies and role trusts. It supports use IAM Access Analyzer external-access analysis against the organization as the zone of trust. With external principals also required, IAM Access Analyzer is the appropriate IAM Access Analyzer control.
2. AWS Trusted Advisor only is AWS best-practice recommendations for external access. The scenario requires organization zone of trust, so this alternative is insufficient. IAM Access Analyzer addresses resource policies and role trusts within this policy analysis scenario. By comparison, AWS Trusted Advisor only leaves external principals unresolved.
3. Amazon CloudWatch Synthetics is synthetic endpoint monitoring for external access. The scenario requires resource policies and role trusts, so this alternative is insufficient. IAM Access Analyzer addresses external principals within this policy analysis scenario. By comparison, Amazon CloudWatch Synthetics leaves organization zone of trust unresolved.
4. AWS Cost Explorer is cost and usage analysis for external access. The scenario requires external principals, so this alternative is insufficient. IAM Access Analyzer addresses organization zone of trust within this policy analysis scenario. By comparison, AWS Cost Explorer leaves resource policies and role trusts unresolved.

 

Question 8

Member accounts may run workloads only in two approved Regions, while global services such as IAM must remain usable. Which centralized governance approach is most appropriate?

1. Use a tag policy to block API calls
2. Attach a Region-deny SCP with required global-service exceptions
3. Create a security group in every Region
4. Disable consolidated billing

Correct Answer(s)

 

B

Rationale

1. Use a tag policy to block API calls is organization-wide tag standards for RequestedRegion. The scenario requires global services still required, so this alternative is insufficient. Attach a Region-deny SCP with required global-service exceptions addresses member accounts within this region governance scenario. By comparison, Use a tag policy to block API calls leaves two approved Regions unresolved.
2. Attach a Region-deny SCP with required global-service exceptions is organization-wide permission ceilings for RequestedRegion, matching member accounts. It supports enforce member-account region restrictions with an SCP deny pattern that preserves required global services. With two approved Regions also required, Attach a Region-deny SCP with required global-service exceptions is the appropriate SCP control.
3. Create a security group in every Region is stateful network filtering for RequestedRegion. The scenario requires member accounts, so this alternative is insufficient. Attach a Region-deny SCP with required global-service exceptions addresses two approved Regions within this region governance scenario. By comparison, Create a security group in every Region leaves global services still required unresolved.
4. Disable consolidated billing is organization billing aggregation for RequestedRegion. The scenario requires two approved Regions, so this alternative is insufficient. Attach a Region-deny SCP with required global-service exceptions addresses global services still required within this region governance scenario. By comparison, Disable consolidated billing leaves member accounts unresolved.

 

Question 9

An administrator attaches an SCP containing Allow statements for Amazon S3 to an OU, but users in a member account still cannot access S3 because they have no IAM permissions. What explains the result?

1. SCPs are evaluated after CloudTrail logging
2. SCPs apply only to the management account
3. SCPs require a VPC endpoint
4. SCPs set permission boundaries but do not grant permissions

Correct Answer(s)

 

D

Rationale

1. SCPs are evaluated after CloudTrail logging is organization-wide permission ceilings for permission boundary. The scenario requires permission still denied, so this alternative is insufficient. SCPs set permission boundaries but do not grant permissions addresses OU SCP allows S3 within this IAM scenario. By comparison, SCPs are evaluated after CloudTrail logging leaves users lack IAM grants unresolved.
2. SCPs apply only to the management account is organization-wide permission ceilings for permission boundary. The scenario requires OU SCP allows S3, so this alternative is insufficient. SCPs set permission boundaries but do not grant permissions addresses users lack IAM grants within this IAM scenario. By comparison, SCPs apply only to the management account leaves permission still denied unresolved.
3. SCPs require a VPC endpoint is organization-wide permission ceilings for permission boundary. The scenario requires users lack IAM grants, so this alternative is insufficient. SCPs set permission boundaries but do not grant permissions addresses permission still denied within this IAM scenario. By comparison, SCPs require a VPC endpoint leaves OU SCP allows S3 unresolved.
4. SCPs set permission boundaries but do not grant permissions is organization-wide permission ceilings for permission boundary, matching OU SCP allows S3. It supports treat SCP Allow statements as maximum-permission guardrails while granting actual access with IAM or resource policies. With users lack IAM grants also required, SCPs set permission boundaries but do not grant permissions is the appropriate SCP control.

 

Question 10

The security team attaches a restrictive SCP to the organization root and expects it to constrain an administrator signed in to the AWS Organizations management account. The administrator is unaffected. Why?

1. Root-level SCPs affect only billing APIs
2. The administrator needs to refresh STS credentials
3. The SCP must be converted to a tag policy
4. SCPs do not restrict identities in the management account

Correct Answer(s)

 

D

Rationale

1. Root-level SCPs affect only billing APIs is organization-wide permission ceilings for management account. The scenario requires administrator unaffected, so this alternative is insufficient. SCPs do not restrict identities in the management account addresses management account within this Organizations scenario. By comparison, Root-level SCPs affect only billing APIs leaves root-attached SCP unresolved.
2. The administrator needs to refresh STS credentials is temporary credential lifecycle handling for management account. The scenario requires management account, so this alternative is insufficient. SCPs do not restrict identities in the management account addresses root-attached SCP within this Organizations scenario. By comparison, The administrator needs to refresh STS credentials leaves administrator unaffected unresolved.
3. The SCP must be converted to a tag policy is organization-wide permission ceilings for management account. The scenario requires root-attached SCP, so this alternative is insufficient. SCPs do not restrict identities in the management account addresses administrator unaffected within this Organizations scenario. By comparison, The SCP must be converted to a tag policy leaves management account unresolved.
4. SCPs do not restrict identities in the management account is organization-wide permission ceilings for management account, matching management account. It supports recognize that SCP enforcement covers member-account identities but not users or roles in the management account. With root-attached SCP also required, SCPs do not restrict identities in the management account is the appropriate SCP control.

 

Question 11

A member account has an SCP denying iam:* actions. An AWS service’s service-linked role continues to perform the IAM-related operations needed by that service. Which AWS Organizations behavior accounts for this?

1. SCPs do not restrict service-linked roles
2. Service-linked roles are root users
3. SCPs affect only resource policies
4. Service-linked roles automatically detach the SCP

Correct Answer(s)

 

A

Rationale

1. SCPs do not restrict service-linked roles is organization-wide permission ceilings for service-linked role, matching member account. It supports account for the documented SCP exception that leaves service-linked roles outside SCP restriction. With service-linked role also required, SCPs do not restrict service-linked roles is the appropriate SCP control.
2. Service-linked roles are root users is AWS-service operational permissions for service-linked role. The scenario requires SCP deny, so this alternative is insufficient. SCPs do not restrict service-linked roles addresses member account within this exception scenario. By comparison, Service-linked roles are root users leaves service-linked role unresolved.
3. SCPs affect only resource policies is organization-wide permission ceilings for service-linked role. The scenario requires member account, so this alternative is insufficient. SCPs do not restrict service-linked roles addresses service-linked role within this exception scenario. By comparison, SCPs affect only resource policies leaves SCP deny unresolved.
4. Service-linked roles automatically detach the SCP is organization-wide permission ceilings for service-linked role. The scenario requires service-linked role, so this alternative is insufficient. SCPs do not restrict service-linked roles addresses SCP deny within this exception scenario. By comparison, Service-linked roles automatically detach the SCP leaves member account unresolved.

 

Question 12

A company wants every account under the Sandbox OU, including accounts in nested child OUs, to be unable to create internet gateways. Where should the preventive permissions boundary be applied for broad inheritance?

1. Add a bucket policy to the logging account
2. Attach an SCP to the Sandbox OU
3. Attach an IAM policy to one administrator
4. Create a Control Tower detective control only

Correct Answer(s)

 

B

Rationale

1. Add a bucket policy to the logging account is resource-side principal authorization for OU inheritance. The scenario requires central preventive boundary, so this alternative is insufficient. Attach an SCP to the Sandbox OU addresses nested child OUs within this Organizations scenario. By comparison, Add a bucket policy to the logging account leaves all sandbox accounts unresolved.
2. Attach an SCP to the Sandbox OU is organization-wide permission ceilings for OU inheritance, matching nested child OUs. It supports attach the internet-gateway denial SCP at the parent Sandbox OU so member accounts inherit the guardrail. With all sandbox accounts also required, Attach an SCP to the Sandbox OU is the appropriate SCP control.
3. Attach an IAM policy to one administrator is principal-side permission authorization for OU inheritance. The scenario requires nested child OUs, so this alternative is insufficient. Attach an SCP to the Sandbox OU addresses all sandbox accounts within this Organizations scenario. By comparison, Attach an IAM policy to one administrator leaves central preventive boundary unresolved.
4. Create a Control Tower detective control only is postdeployment compliance detection for OU inheritance. The scenario requires all sandbox accounts, so this alternative is insufficient. Attach an SCP to the Sandbox OU addresses central preventive boundary within this Organizations scenario. By comparison, Create a Control Tower detective control only leaves nested child OUs unresolved.

 

Question 13

A security team wants to manage GuardDuty organization-wide from a security account rather than use the management account for day-to-day administration. Which organizational pattern best supports this?

1. Create an SCP that grants GuardDuty permissions
2. Share the management-account root credentials
3. Move the security account to the organization root
4. Register the security account as the service’s delegated administrator

Correct Answer(s)

 

D

Rationale

1. Create an SCP that grants GuardDuty permissions is organization-wide permission ceilings for GuardDuty. The scenario requires organization-wide service, so this alternative is insufficient. Register the security account as the service’s delegated administrator addresses central security operations within this Organizations scenario. By comparison, Create an SCP that grants GuardDuty permissions leaves avoid daily management-account use unresolved.
2. Share the management-account root credentials is management-account root authentication for GuardDuty. The scenario requires central security operations, so this alternative is insufficient. Register the security account as the service’s delegated administrator addresses avoid daily management-account use within this Organizations scenario. By comparison, Share the management-account root credentials leaves organization-wide service unresolved.
3. Move the security account to the organization root is organization hierarchy administration for GuardDuty. The scenario requires avoid daily management-account use, so this alternative is insufficient. Register the security account as the service’s delegated administrator addresses organization-wide service within this Organizations scenario. By comparison, Move the security account to the organization root leaves central security operations unresolved.
4. Register the security account as the service’s delegated administrator is member-account service administration for GuardDuty, matching central security operations. It supports delegate organization-wide GuardDuty administration to a designated member security account. With avoid daily management-account use also required, Register the security account as the service’s delegated administrator is the appropriate delegated administrator control.

 

Question 14

A company created an AWS Organization with consolidated billing features only. Security wants to attach SCPs to OUs. What must happen first?

1. Enable S3 Versioning in the management account
2. Create a resource share in AWS RAM
3. Enable all features for the organization
4. Register every OU with Control Tower

Correct Answer(s)

 

C

Rationale

1. Enable S3 Versioning in the management account is organization hierarchy administration for all features. The scenario requires OU governance, so this alternative is insufficient. Enable all features for the organization addresses consolidated billing only within this SCP scenario. By comparison, Enable S3 Versioning in the management account leaves needs SCPs unresolved.
2. Create a resource share in AWS RAM is managed cross-account resource sharing for all features. The scenario requires consolidated billing only, so this alternative is insufficient. Enable all features for the organization addresses needs SCPs within this SCP scenario. By comparison, Create a resource share in AWS RAM leaves OU governance unresolved.
3. Enable all features for the organization is full Organizations governance capabilities for all features, matching consolidated billing only. It supports enable AWS Organizations all-features mode before using service control policies. With needs SCPs also required, Enable all features for the organization is the appropriate Organizations control.
4. Register every OU with Control Tower is Control Tower OU enrollment for all features. The scenario requires needs SCPs, so this alternative is insufficient. Enable all features for the organization addresses OU governance within this SCP scenario. By comparison, Register every OU with Control Tower leaves consolidated billing only unresolved.

 

Question 15

A cloud governance team wants a repeatable way to provision new AWS accounts into a governed landing zone with approved account metadata and baseline controls. Which AWS Control Tower capability is intended for this?

1. AWS RAM managed permissions
2. Account Factory
3. AWS Artifact reports
4. IAM Access Analyzer policy generation

Correct Answer(s)

 

B

Rationale

1. AWS RAM managed permissions is managed cross-account resource sharing for Account Factory. The scenario requires landing-zone governance, so this alternative is insufficient. Account Factory addresses new accounts within this account provisioning scenario. By comparison, AWS RAM managed permissions leaves repeatable provisioning unresolved.
2. Account Factory is governed AWS account provisioning for Account Factory, matching new accounts. It supports provision standardized governed accounts through AWS Control Tower Account Factory. With repeatable provisioning also required, Account Factory is the appropriate Control Tower control.
3. AWS Artifact reports is compliance-report retrieval for Account Factory. The scenario requires new accounts, so this alternative is insufficient. Account Factory addresses repeatable provisioning within this account provisioning scenario. By comparison, AWS Artifact reports leaves landing-zone governance unresolved.
4. IAM Access Analyzer policy generation is external-access policy analysis for Account Factory. The scenario requires repeatable provisioning, so this alternative is insufficient. Account Factory addresses landing-zone governance within this account provisioning scenario. By comparison, IAM Access Analyzer policy generation leaves new accounts unresolved.

 

Question 16

An organization must stop member-account users from disabling a required security service before the API call can succeed. Which Control Tower control behavior is the best fit?

1. Cost optimization recommendation
2. Preventive control
3. CloudWatch dashboard
4. Detective control

Correct Answer(s)

 

B

Rationale

1. Cost optimization recommendation is cost-efficiency recommendations for preventive control. The scenario requires governance control, so this alternative is insufficient. Preventive control addresses must block action within this governance scenario. By comparison, Cost optimization recommendation leaves member accounts unresolved.
2. Preventive control is policy-based operation prevention for preventive control, matching must block action. It supports use a preventive Control Tower control when the governance requirement is to block a prohibited action. With member accounts also required, Preventive control is the appropriate Control Tower control.
3. CloudWatch dashboard is metrics visualization for preventive control. The scenario requires must block action, so this alternative is insufficient. Preventive control addresses member accounts within this governance scenario. By comparison, CloudWatch dashboard leaves governance control unresolved.
4. Detective control is postdeployment compliance detection for preventive control. The scenario requires member accounts, so this alternative is insufficient. Preventive control addresses governance control within this governance scenario. By comparison, Detective control leaves must block action unresolved.

 

Question 17

A governance team can tolerate a resource being created, but it needs ongoing notification when the resource later violates a configuration requirement. Which Control Tower control type best matches this objective?

1. Detective control
2. Preventive control
3. Proactive control only
4. Consolidated billing rule

Correct Answer(s)

 

A

Rationale

1. Detective control is postdeployment compliance detection for detective control, matching ongoing evaluation. It supports use a detective Control Tower control for post-deployment compliance evaluation and findings. With resource may already exist also required, Detective control is the appropriate Control Tower control.
2. Preventive control is policy-based operation prevention for detective control. The scenario requires notify on noncompliance, so this alternative is insufficient. Detective control addresses ongoing evaluation within this AWS Config scenario. By comparison, Preventive control leaves resource may already exist unresolved.
3. Proactive control only is predeployment configuration validation for detective control. The scenario requires ongoing evaluation, so this alternative is insufficient. Detective control addresses resource may already exist within this AWS Config scenario. By comparison, Proactive control only leaves notify on noncompliance unresolved.
4. Consolidated billing rule is organization billing aggregation for detective control. The scenario requires resource may already exist, so this alternative is insufficient. Detective control addresses notify on noncompliance within this AWS Config scenario. By comparison, Consolidated billing rule leaves ongoing evaluation unresolved.

 

Question 18

Infrastructure teams deploy through AWS CloudFormation. Governance wants a noncompliant resource definition rejected before CloudFormation provisions it. Which Control Tower control category is designed for this stage?

1. IAM access key report
2. Detective control
3. Proactive control
4. Billing policy

Correct Answer(s)

 

C

Rationale

1. IAM access key report is IAM credential inventory for proactive control. The scenario requires reject noncompliant resource, so this alternative is insufficient. Proactive control addresses CloudFormation deployment within this CloudFormation scenario. By comparison, IAM access key report leaves pre-provision validation unresolved.
2. Detective control is postdeployment compliance detection for proactive control. The scenario requires CloudFormation deployment, so this alternative is insufficient. Proactive control addresses pre-provision validation within this CloudFormation scenario. By comparison, Detective control leaves reject noncompliant resource unresolved.
3. Proactive control is predeployment configuration validation for proactive control, matching CloudFormation deployment. It supports apply a proactive Control Tower control to validate CloudFormation resources before provisioning. With pre-provision validation also required, Proactive control is the appropriate Control Tower control.
4. Billing policy is organization billing governance for proactive control. The scenario requires pre-provision validation, so this alternative is insufficient. Proactive control addresses reject noncompliant resource within this CloudFormation scenario. By comparison, Billing policy leaves CloudFormation deployment unresolved.

 

Question 19

A company already has an OU containing existing member accounts. It wants those accounts brought under AWS Control Tower governance instead of creating replacement accounts. Which operation is appropriate?

1. Convert the OU to an SCP
2. Share the OU with AWS RAM
3. Register the existing OU with AWS Control Tower
4. Delete and recreate the OU with Account Factory

Correct Answer(s)

 

C

Rationale

1. Convert the OU to an SCP is organization-wide permission ceilings for register OU. The scenario requires adopt into landing zone, so this alternative is insufficient. Register the existing OU with AWS Control Tower addresses existing OU within this existing accounts scenario. By comparison, Convert the OU to an SCP leaves existing accounts unresolved.
2. Share the OU with AWS RAM is managed cross-account resource sharing for register OU. The scenario requires existing OU, so this alternative is insufficient. Register the existing OU with AWS Control Tower addresses existing accounts within this existing accounts scenario. By comparison, Share the OU with AWS RAM leaves adopt into landing zone unresolved.
3. Register the existing OU with AWS Control Tower is Control Tower OU enrollment for register OU, matching existing OU. It supports register an existing organizational unit so its eligible accounts are brought under Control Tower governance. With existing accounts also required, Register the existing OU with AWS Control Tower is the appropriate Control Tower control.
4. Delete and recreate the OU with Account Factory is governed AWS account provisioning for register OU. The scenario requires existing accounts, so this alternative is insufficient. Register the existing OU with AWS Control Tower addresses adopt into landing zone within this existing accounts scenario. By comparison, Delete and recreate the OU with Account Factory leaves existing OU unresolved.

 

Question 20

Security wants a centrally managed organization policy that limits which external principals may access supported resources in member accounts, rather than limiting what member-account IAM identities can call. Which Organizations policy type targets the resource side?

1. Service control policy (SCP)
2. Tag policy
3. Backup policy
4. Resource control policy (RCP)

Correct Answer(s)

 

D

Rationale

1. Service control policy (SCP) is organization-wide permission ceilings for Organizations. The scenario requires member-account resources, so this alternative is insufficient. Resource control policy (RCP) addresses resource-side boundary within this resource perimeter scenario. By comparison, Service control policy (SCP) leaves external principals unresolved.
2. Tag policy is organization-wide tag standards for Organizations. The scenario requires resource-side boundary, so this alternative is insufficient. Resource control policy (RCP) addresses external principals within this resource perimeter scenario. By comparison, Tag policy leaves member-account resources unresolved.
3. Backup policy is organization-wide backup governance for Organizations. The scenario requires external principals, so this alternative is insufficient. Resource control policy (RCP) addresses member-account resources within this resource perimeter scenario. By comparison, Backup policy leaves resource-side boundary unresolved.
4. Resource control policy (RCP) is organization-wide resource permission ceilings for Organizations, matching resource-side boundary. It supports use an Organizations resource control policy to bound external principal access to supported member-account resources. With external principals also required, Resource control policy (RCP) is the appropriate RCP control.

• < Amazon AWS SAA-C03 IAM, Federation, Identity Center, and Least-Privilege Access Practice Test 3
• Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 2 >