Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 3

 

Topic 02 Practice Test 3 covers Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A central networking account creates VPC subnets that application teams in several member accounts should launch resources into while the networking team retains ownership of the VPC. Which sharing model is appropriate?

1. Create IAM users in the networking account for every developer
2. Share the subnets with the member accounts by using AWS RAM
3. Copy the subnet CIDRs into each account with CloudFormation
4. Use an SCP to grant subnet ownership

Correct Answer(s)

 

B

Rationale

1. Create IAM users in the networking account for every developer is long-lived account credentials for VPC sharing. The scenario requires member accounts launch resources, so this alternative is insufficient. Share the subnets with the member accounts by using AWS RAM addresses retain network ownership within this subnets scenario. By comparison, Create IAM users in the networking account for every developer leaves central VPC owner unresolved.
2. Share the subnets with the member accounts by using AWS RAM is managed cross-account resource sharing for VPC sharing, matching central VPC owner. It supports use AWS RAM VPC sharing so application accounts consume centrally owned subnets without duplicating the VPC. With member accounts launch resources also required, Share the subnets with the member accounts by using AWS RAM is the appropriate AWS RAM control.
3. Copy the subnet CIDRs into each account with CloudFormation is multi-account infrastructure deployment for VPC sharing. The scenario requires retain network ownership, so this alternative is insufficient. Share the subnets with the member accounts by using AWS RAM addresses central VPC owner within this subnets scenario. By comparison, Copy the subnet CIDRs into each account with CloudFormation leaves member accounts launch resources unresolved.
4. Use an SCP to grant subnet ownership is organization-wide permission ceilings for VPC sharing. The scenario requires central VPC owner, so this alternative is insufficient. Share the subnets with the member accounts by using AWS RAM addresses member accounts launch resources within this subnets scenario. By comparison, Use an SCP to grant subnet ownership leaves retain network ownership unresolved.

 

Question 2

A network team owns a Transit Gateway and wants every current and future account in the Applications OU to be eligible to use it without maintaining an account-ID list. Which design best fits?

1. Create a separate Transit Gateway in every account
2. Use an S3 bucket policy with Principal ‘*’
3. Attach an SCP granting transit-gateway ownership
4. Create an AWS RAM resource share targeted to the Applications OU

Correct Answer(s)

 

D

Rationale

1. Create a separate Transit Gateway in every account is centralized VPC transit routing for Transit Gateway. The scenario requires whole OU, so this alternative is insufficient. Create an AWS RAM resource share targeted to the Applications OU addresses avoid account list within this OU scenario. By comparison, Create a separate Transit Gateway in every account leaves Transit Gateway unresolved.
2. Use an S3 bucket policy with Principal ‘*’ is resource-side principal authorization for Transit Gateway. The scenario requires avoid account list, so this alternative is insufficient. Create an AWS RAM resource share targeted to the Applications OU addresses Transit Gateway within this OU scenario. By comparison, Use an S3 bucket policy with Principal ‘*’ leaves whole OU unresolved.
3. Attach an SCP granting transit-gateway ownership is organization-wide permission ceilings for Transit Gateway. The scenario requires Transit Gateway, so this alternative is insufficient. Create an AWS RAM resource share targeted to the Applications OU addresses whole OU within this OU scenario. By comparison, Attach an SCP granting transit-gateway ownership leaves avoid account list unresolved.
4. Create an AWS RAM resource share targeted to the Applications OU is managed cross-account resource sharing for Transit Gateway, matching Transit Gateway. It supports share the central Transit Gateway with the Applications OU through AWS RAM for membership-aware access. With whole OU also required, Create an AWS RAM resource share targeted to the Applications OU is the appropriate AWS RAM control.

 

Question 3

A DNS team centralizes Route 53 Resolver rules in one account and needs multiple application accounts to associate those rules with their VPCs. Which cross-account mechanism should be evaluated first?

1. AWS RAM sharing for the Resolver rules
2. CloudFront origin access control
3. IAM password policy replication
4. An SCP that allows route53resolver:*

Correct Answer(s)

 

A

Rationale

1. AWS RAM sharing for the Resolver rules is managed cross-account resource sharing for Route 53 Resolver, matching central DNS rules. It supports share centrally managed Route 53 Resolver rules across accounts with AWS RAM. With multiple VPC accounts also required, AWS RAM sharing for the Resolver rules is the appropriate AWS RAM control.
2. CloudFront origin access control is CloudFront origin authorization for Route 53 Resolver. The scenario requires multiple VPC accounts, so this alternative is insufficient. AWS RAM sharing for the Resolver rules addresses cross-account reuse within this DNS scenario. By comparison, CloudFront origin access control leaves central DNS rules unresolved.
3. IAM password policy replication is IAM password requirements for Route 53 Resolver. The scenario requires cross-account reuse, so this alternative is insufficient. AWS RAM sharing for the Resolver rules addresses central DNS rules within this DNS scenario. By comparison, IAM password policy replication leaves multiple VPC accounts unresolved.
4. An SCP that allows route53resolver:* is organization-wide permission ceilings for Route 53 Resolver. The scenario requires central DNS rules, so this alternative is insufficient. AWS RAM sharing for the Resolver rules addresses multiple VPC accounts within this DNS scenario. By comparison, An SCP that allows route53resolver:* leaves cross-account reuse unresolved.

 

Question 4

A supported resource is shared through AWS RAM to an OU with Organizations integration enabled. One consumer account later leaves the organization. No special retention option was configured. What is the expected default outcome?

1. The resource is copied into the departed account
2. The departed account loses access to the organization-scoped share
3. The account keeps permanent access automatically
4. The share converts into an SCP

Correct Answer(s)

 

B

Rationale

1. The resource is copied into the departed account is RAM share lifecycle behavior for account departure. The scenario requires Organizations integration, so this alternative is insufficient. The departed account loses access to the organization-scoped share addresses account leaves organization within this Organizations scenario. By comparison, The resource is copied into the departed account leaves OU resource share unresolved.
2. The departed account loses access to the organization-scoped share is RAM share lifecycle behavior for account departure, matching OU resource share. It supports expect default organization-scoped AWS RAM access to end when a consumer account leaves the organization. With Organizations integration also required, The departed account loses access to the organization-scoped share is the appropriate AWS RAM control.
3. The account keeps permanent access automatically is RAM share lifecycle behavior for account departure. The scenario requires account leaves organization, so this alternative is insufficient. The departed account loses access to the organization-scoped share addresses OU resource share within this Organizations scenario. By comparison, The account keeps permanent access automatically leaves Organizations integration unresolved.
4. The share converts into an SCP is organization-wide permission ceilings for account departure. The scenario requires OU resource share, so this alternative is insufficient. The departed account loses access to the organization-scoped share addresses Organizations integration within this Organizations scenario. By comparison, The share converts into an SCP leaves account leaves organization unresolved.

 

Question 5

A build role in Account B must pull container images from a private Amazon ECR repository in Account A. Which authorization combination best supports cross-account pulls?

1. An Organizations tag policy only
2. A CloudFront distribution in Account A
3. Security group rules on the ECR repository
4. Repository policy in Account A plus caller permissions in Account B

Correct Answer(s)

 

D

Rationale

1. An Organizations tag policy only is organization-wide tag standards for repository policy. The scenario requires different account, so this alternative is insufficient. Repository policy in Account A plus caller permissions in Account B addresses build role pulls images within this cross-account scenario. By comparison, An Organizations tag policy only leaves private ECR repository unresolved.
2. A CloudFront distribution in Account A is content delivery network distribution for repository policy. The scenario requires build role pulls images, so this alternative is insufficient. Repository policy in Account A plus caller permissions in Account B addresses private ECR repository within this cross-account scenario. By comparison, A CloudFront distribution in Account A leaves different account unresolved.
3. Security group rules on the ECR repository is stateful network filtering for repository policy. The scenario requires private ECR repository, so this alternative is insufficient. Repository policy in Account A plus caller permissions in Account B addresses different account within this cross-account scenario. By comparison, Security group rules on the ECR repository leaves build role pulls images unresolved.
4. Repository policy in Account A plus caller permissions in Account B is resource-side principal authorization for repository policy, matching private ECR repository. It supports authorize cross-account ECR image pulls with repository-side policy trust plus the consuming role’s required ECR permissions. With different account also required, Repository policy in Account A plus caller permissions in Account B is the appropriate ECR control.

 

Question 6

An application role in Account B must publish messages to an SNS topic in Account A. The topic should remain owned and managed in Account A. Which policy pattern is appropriate?

1. A network ACL allowing TCP 443
2. A tag policy that names the topic ARN
3. SNS topic resource policy plus caller-side sns:Publish permission
4. A Route 53 health check

Correct Answer(s)

 

C

Rationale

1. A network ACL allowing TCP 443 is stateless subnet filtering for resource policy. The scenario requires publisher Account B, so this alternative is insufficient. SNS topic resource policy plus caller-side sns:Publish permission addresses retain ownership within this cross-account scenario. By comparison, A network ACL allowing TCP 443 leaves SNS topic owner Account A unresolved.
2. A tag policy that names the topic ARN is organization-wide tag standards for resource policy. The scenario requires retain ownership, so this alternative is insufficient. SNS topic resource policy plus caller-side sns:Publish permission addresses SNS topic owner Account A within this cross-account scenario. By comparison, A tag policy that names the topic ARN leaves publisher Account B unresolved.
3. SNS topic resource policy plus caller-side sns:Publish permission is resource-side principal authorization for resource policy, matching SNS topic owner Account A. It supports permit cross-account SNS publishing with a topic resource policy and matching caller identity permission. With publisher Account B also required, SNS topic resource policy plus caller-side sns:Publish permission is the appropriate SNS control.
4. A Route 53 health check is endpoint health monitoring for resource policy. The scenario requires SNS topic owner Account A, so this alternative is insufficient. SNS topic resource policy plus caller-side sns:Publish permission addresses publisher Account B within this cross-account scenario. By comparison, A Route 53 health check leaves retain ownership unresolved.

 

Question 7

A workload in Account B must send work items directly to an SQS queue owned by Account A. There is no role assumption in the design. Which authorization is required?

1. A CloudWatch alarm on queue depth
2. VPC peering between the accounts
3. Queue policy granting the external principal and caller IAM permission
4. AWS Organizations backup policy

Correct Answer(s)

 

C

Rationale

1. A CloudWatch alarm on queue depth is metric threshold alerting for queue policy. The scenario requires direct cross-account call, so this alternative is insufficient. Queue policy granting the external principal and caller IAM permission addresses no role assumption within this cross-account scenario. By comparison, A CloudWatch alarm on queue depth leaves SQS queue unresolved.
2. VPC peering between the accounts is private VPC-to-VPC connectivity for queue policy. The scenario requires no role assumption, so this alternative is insufficient. Queue policy granting the external principal and caller IAM permission addresses SQS queue within this cross-account scenario. By comparison, VPC peering between the accounts leaves direct cross-account call unresolved.
3. Queue policy granting the external principal and caller IAM permission is resource-side principal authorization for queue policy, matching SQS queue. It supports enable direct cross-account SQS SendMessage through queue-side resource permission plus caller authorization. With direct cross-account call also required, Queue policy granting the external principal and caller IAM permission is the appropriate SQS control.
4. AWS Organizations backup policy is organization-wide backup governance for queue policy. The scenario requires SQS queue, so this alternative is insufficient. Queue policy granting the external principal and caller IAM permission addresses direct cross-account call within this cross-account scenario. By comparison, AWS Organizations backup policy leaves no role assumption unresolved.

 

Question 8

A deployment system in Account B invokes a Lambda function in Account A without assuming a role in Account A. Which control on the function authorizes the cross-account invocation?

1. An SCP that grants lambda:InvokeFunction
2. An S3 access point policy
3. A security group attached to the function
4. Lambda resource-based permission for the external principal

Correct Answer(s)

 

D

Rationale

1. An SCP that grants lambda:InvokeFunction is organization-wide permission ceilings for resource policy. The scenario requires caller Account B, so this alternative is insufficient. Lambda resource-based permission for the external principal addresses direct invocation within this cross-account scenario. By comparison, An SCP that grants lambda:InvokeFunction leaves Lambda function owner Account A unresolved.
2. An S3 access point policy is object-storage access control for resource policy. The scenario requires direct invocation, so this alternative is insufficient. Lambda resource-based permission for the external principal addresses Lambda function owner Account A within this cross-account scenario. By comparison, An S3 access point policy leaves caller Account B unresolved.
3. A security group attached to the function is stateful network filtering for resource policy. The scenario requires Lambda function owner Account A, so this alternative is insufficient. Lambda resource-based permission for the external principal addresses caller Account B within this cross-account scenario. By comparison, A security group attached to the function leaves direct invocation unresolved.
4. Lambda resource-based permission for the external principal is serverless function authorization for resource policy, matching Lambda function owner Account A. It supports authorize direct cross-account Lambda invocation with a function resource-based policy statement. With caller Account B also required, Lambda resource-based permission for the external principal is the appropriate Lambda control.

 

Question 9

A role in Account B needs to read a secret in Account A. The secret uses a customer managed KMS key. Which design accounts for both the secret and encryption authorization boundaries?

1. Only a Secrets Manager rotation schedule
2. Only an SCP allowing secretsmanager:GetSecretValue
3. Secret resource policy plus cross-account KMS key and IAM permissions
4. A VPC network ACL plus NAT gateway

Correct Answer(s)

 

C

Rationale

1. Only a Secrets Manager rotation schedule is managed secret access for KMS. The scenario requires caller in Account B, so this alternative is insufficient. Secret resource policy plus cross-account KMS key and IAM permissions addresses customer managed KMS key within this cross-account scenario. By comparison, Only a Secrets Manager rotation schedule leaves secret in Account A unresolved.
2. Only an SCP allowing secretsmanager:GetSecretValue is organization-wide permission ceilings for KMS. The scenario requires customer managed KMS key, so this alternative is insufficient. Secret resource policy plus cross-account KMS key and IAM permissions addresses secret in Account A within this cross-account scenario. By comparison, Only an SCP allowing secretsmanager:GetSecretValue leaves caller in Account B unresolved.
3. Secret resource policy plus cross-account KMS key and IAM permissions is KMS key-use authorization for KMS, matching secret in Account A. It supports combine Secrets Manager resource-policy trust with the necessary cross-account KMS key authorization for encrypted secret retrieval. With caller in Account B also required, Secret resource policy plus cross-account KMS key and IAM permissions is the appropriate Secrets Manager control.
4. A VPC network ACL plus NAT gateway is stateless subnet filtering for KMS. The scenario requires secret in Account A, so this alternative is insufficient. Secret resource policy plus cross-account KMS key and IAM permissions addresses caller in Account B within this cross-account scenario. By comparison, A VPC network ACL plus NAT gateway leaves customer managed KMS key unresolved.

 

Question 10

A producer in Account B must send custom events to an EventBridge event bus in Account A. The producer will call PutEvents directly. Which authorization model should be used?

1. A Control Tower detective control
2. S3 bucket policy on the archive bucket
3. Event bus resource policy plus producer IAM permission
4. Security group referencing the producer

Correct Answer(s)

 

C

Rationale

1. A Control Tower detective control is postdeployment compliance detection for resource policy. The scenario requires direct PutEvents, so this alternative is insufficient. Event bus resource policy plus producer IAM permission addresses different accounts within this cross-account scenario. By comparison, A Control Tower detective control leaves custom event bus unresolved.
2. S3 bucket policy on the archive bucket is resource-side principal authorization for resource policy. The scenario requires different accounts, so this alternative is insufficient. Event bus resource policy plus producer IAM permission addresses custom event bus within this cross-account scenario. By comparison, S3 bucket policy on the archive bucket leaves direct PutEvents unresolved.
3. Event bus resource policy plus producer IAM permission is resource-side principal authorization for resource policy, matching custom event bus. It supports allow cross-account EventBridge PutEvents by combining event-bus resource permission with producer-side IAM authorization. With direct PutEvents also required, Event bus resource policy plus producer IAM permission is the appropriate EventBridge control.
4. Security group referencing the producer is stateful network filtering for resource policy. The scenario requires custom event bus, so this alternative is insufficient. Event bus resource policy plus producer IAM permission addresses direct PutEvents within this cross-account scenario. By comparison, Security group referencing the producer leaves different accounts unresolved.

 

Question 11

A shared S3 data lake must remain accessible to any present or future account in one AWS Organization, but not to external accounts. Administrators do not want to edit the bucket policy whenever accounts are added. Which condition is best?

1. aws:RequestedRegion only
2. s3:VersionId
3. aws:SourceVpce only
4. aws:PrincipalOrgID

Correct Answer(s)

 

D

Rationale

1. aws:RequestedRegion only is region-request context filtering for PrincipalOrgID. The scenario requires block external organizations, so this alternative is insufficient. aws:PrincipalOrgID addresses avoid policy edits within this organization perimeter scenario. By comparison, aws:RequestedRegion only leaves future member accounts unresolved.
2. s3:VersionId is object-storage access control for PrincipalOrgID. The scenario requires avoid policy edits, so this alternative is insufficient. aws:PrincipalOrgID addresses future member accounts within this organization perimeter scenario. By comparison, s3:VersionId leaves block external organizations unresolved.
3. aws:SourceVpce only is source-VPC context filtering for PrincipalOrgID. The scenario requires future member accounts, so this alternative is insufficient. aws:PrincipalOrgID addresses block external organizations within this organization perimeter scenario. By comparison, aws:SourceVpce only leaves avoid policy edits unresolved.
4. aws:PrincipalOrgID is organization-membership policy filtering for PrincipalOrgID, matching future member accounts. It supports make the data-lake bucket membership-aware by restricting access with aws PrincipalOrgID rather than enumerated accounts. With block external organizations also required, aws:PrincipalOrgID is the appropriate S3 control.

 

Question 12

A company wants one centrally attached Organizations policy to prevent principals outside the organization from accessing supported resources in member accounts, even when an individual resource owner writes an overly broad resource policy. Which control addresses that direction of access?

1. Resource control policy (RCP)
2. Service control policy (SCP) only
3. IAM password policy
4. Cost allocation tag

Correct Answer(s)

 

A

Rationale

1. Resource control policy (RCP) is organization-wide resource permission ceilings for resource perimeter, matching external principal direction. It supports apply an RCP as a centralized resource-side permissions ceiling against unwanted external access to supported resources. With member-account resources also required, Resource control policy (RCP) is the appropriate RCP control.
2. Service control policy (SCP) only is organization-wide permission ceilings for resource perimeter. The scenario requires member-account resources, so this alternative is insufficient. Resource control policy (RCP) addresses central organization control within this Organizations scenario. By comparison, Service control policy (SCP) only leaves external principal direction unresolved.
3. IAM password policy is IAM password requirements for resource perimeter. The scenario requires central organization control, so this alternative is insufficient. Resource control policy (RCP) addresses external principal direction within this Organizations scenario. By comparison, IAM password policy leaves member-account resources unresolved.
4. Cost allocation tag is billing-cost categorization for resource perimeter. The scenario requires external principal direction, so this alternative is insufficient. Resource control policy (RCP) addresses member-account resources within this Organizations scenario. By comparison, Cost allocation tag leaves central organization control unresolved.

 

Question 13

A developer role has an IAM policy allowing s3:DeleteBucket, but an SCP inherited from its OU explicitly denies s3:DeleteBucket. What is the effective result?

1. The delete request is denied
2. The SCP becomes a tag policy automatically
3. The IAM Allow overrides the SCP Deny
4. The request succeeds only from the console

Correct Answer(s)

 

A

Rationale

1. The delete request is denied is an IAM authorization outcome for explicit deny, matching IAM Allow present. It supports honor the inherited SCP explicit deny over a member-role IAM allow for bucket deletion. With SCP explicit Deny also required, The delete request is denied is the appropriate SCP control.
2. The SCP becomes a tag policy automatically is organization-wide permission ceilings for explicit deny. The scenario requires SCP explicit Deny, so this alternative is insufficient. The delete request is denied addresses member account within this policy evaluation scenario. By comparison, The SCP becomes a tag policy automatically leaves IAM Allow present unresolved.
3. The IAM Allow overrides the SCP Deny is organization-wide permission ceilings for explicit deny. The scenario requires member account, so this alternative is insufficient. The delete request is denied addresses IAM Allow present within this policy evaluation scenario. By comparison, The IAM Allow overrides the SCP Deny leaves SCP explicit Deny unresolved.
4. The request succeeds only from the console is an IAM authorization outcome for explicit deny. The scenario requires IAM Allow present, so this alternative is insufficient. The delete request is denied addresses SCP explicit Deny within this policy evaluation scenario. By comparison, The request succeeds only from the console leaves member account unresolved.

 

Question 14

An account is beneath the organization root, a BusinessUnits OU, and a Production OU. Each level has SCPs. How are maximum permissions for the account determined?

1. The broadest Allow at any one level wins
2. SCPs are evaluated in random order
3. Only the SCP attached directly to the account matters
4. The action must be permitted by the applicable SCP path at every level

Correct Answer(s)

 

D

Rationale

1. The broadest Allow at any one level wins is an IAM authorization outcome for inheritance. The scenario requires nested OUs, so this alternative is insufficient. The action must be permitted by the applicable SCP path at every level addresses effective permissions within this policy path scenario. By comparison, The broadest Allow at any one level wins leaves multiple SCP levels unresolved.
2. SCPs are evaluated in random order is organization-wide permission ceilings for inheritance. The scenario requires effective permissions, so this alternative is insufficient. The action must be permitted by the applicable SCP path at every level addresses multiple SCP levels within this policy path scenario. By comparison, SCPs are evaluated in random order leaves nested OUs unresolved.
3. Only the SCP attached directly to the account matters is organization-wide permission ceilings for inheritance. The scenario requires multiple SCP levels, so this alternative is insufficient. The action must be permitted by the applicable SCP path at every level addresses nested OUs within this policy path scenario. By comparison, Only the SCP attached directly to the account matters leaves effective permissions unresolved.
4. The action must be permitted by the applicable SCP path at every level is organization-wide permission ceilings for inheritance, matching multiple SCP levels. It supports calculate member-account maximum permissions from the cumulative SCP path through root and parent OUs. With nested OUs also required, The action must be permitted by the applicable SCP path at every level is the appropriate SCP control.

 

Question 15

A member account moves from a Development OU to a Production OU. The two OUs have different SCPs. What governance effect should administrators expect?

1. The account’s inherited SCP set changes with the new OU path
2. Its old OU SCPs remain permanently attached
3. Moving OUs disables Organizations
4. Only tag policies can change after a move

Correct Answer(s)

 

A

Rationale

1. The account’s inherited SCP set changes with the new OU path is organization-wide permission ceilings for OU move, matching account moved between OUs. It supports recalculate inherited guardrails after an account moves because its effective SCP ancestry changes. With different SCPs also required, The account’s inherited SCP set changes with the new OU path is the appropriate SCP control.
2. Its old OU SCPs remain permanently attached is organization-wide permission ceilings for OU move. The scenario requires different SCPs, so this alternative is insufficient. The account’s inherited SCP set changes with the new OU path addresses organization hierarchy within this inheritance scenario. By comparison, Its old OU SCPs remain permanently attached leaves account moved between OUs unresolved.
3. Moving OUs disables Organizations is organization hierarchy reassignment for OU move. The scenario requires organization hierarchy, so this alternative is insufficient. The account’s inherited SCP set changes with the new OU path addresses account moved between OUs within this inheritance scenario. By comparison, Moving OUs disables Organizations leaves different SCPs unresolved.
4. Only tag policies can change after a move is a false OU-policy limitation for OU move. The scenario requires account moved between OUs, so this alternative is insufficient. The account’s inherited SCP set changes with the new OU path addresses different SCPs within this inheritance scenario. By comparison, Only tag policies can change after a move leaves organization hierarchy unresolved.

 

Question 16

A governance team wants consistent CostCenter and DataClassification tag values across organization accounts, but it does not need the policy itself to authorize API calls. Which Organizations policy type is intended for tag standardization?

1. IAM permissions boundary
2. Tag policy
3. Service control policy
4. Resource control policy

Correct Answer(s)

 

B

Rationale

1. IAM permissions boundary is IAM principal permission ceilings for Organizations. The scenario requires organization-wide convention, so this alternative is insufficient. Tag policy addresses not an authorization control within this governance scenario. By comparison, IAM permissions boundary leaves tag consistency unresolved.
2. Tag policy is organization-wide tag standards for Organizations, matching tag consistency. It supports use an Organizations tag policy to standardize tagging conventions without treating it as an API permission grant. With organization-wide convention also required, Tag policy is the appropriate tag policy control.
3. Service control policy is organization-wide permission ceilings for Organizations. The scenario requires not an authorization control, so this alternative is insufficient. Tag policy addresses tag consistency within this governance scenario. By comparison, Service control policy leaves organization-wide convention unresolved.
4. Resource control policy is organization-wide resource permission ceilings for Organizations. The scenario requires tag consistency, so this alternative is insufficient. Tag policy addresses organization-wide convention within this governance scenario. By comparison, Resource control policy leaves not an authorization control unresolved.

 

Question 17

A company wants centrally defined backup-plan expectations applied across selected organization accounts rather than hand-building identical plans in each account. Which Organizations policy family is designed for this governance task?

1. Service control policy granting backup jobs
2. Backup policy
3. IAM role trust policy
4. Tag policy

Correct Answer(s)

 

B

Rationale

1. Service control policy granting backup jobs is organization-wide permission ceilings for Organizations. The scenario requires multiple accounts, so this alternative is insufficient. Backup policy addresses avoid manual duplication within this AWS Backup scenario. By comparison, Service control policy granting backup jobs leaves central backup governance unresolved.
2. Backup policy is organization-wide backup governance for Organizations, matching central backup governance. It supports use an Organizations backup policy to centrally govern backup-plan behavior across targeted accounts. With multiple accounts also required, Backup policy is the appropriate backup policy control.
3. IAM role trust policy is trusted temporary identity delegation for Organizations. The scenario requires avoid manual duplication, so this alternative is insufficient. Backup policy addresses central backup governance within this AWS Backup scenario. By comparison, IAM role trust policy leaves multiple accounts unresolved.
4. Tag policy is organization-wide tag standards for Organizations. The scenario requires central backup governance, so this alternative is insufficient. Backup policy addresses multiple accounts within this AWS Backup scenario. By comparison, Tag policy leaves avoid manual duplication unresolved.

 

Question 18

A security operations account needs consolidated AWS Config compliance information from organization accounts and should be able to administer the aggregation centrally. Which organizational setup is appropriate?

1. Create a public S3 bucket for Config snapshots
2. Use a VPC security group as the organization boundary
3. Use Organizations integration and a delegated administration or aggregation model for AWS Config
4. Attach FullAWSAccess SCP to every account

Correct Answer(s)

 

C

Rationale

1. Create a public S3 bucket for Config snapshots is object-storage access control for delegated administration. The scenario requires multi-account Config data, so this alternative is insufficient. Use Organizations integration and a delegated administration or aggregation model for AWS Config addresses central administration within this Organizations scenario. By comparison, Create a public S3 bucket for Config snapshots leaves security operations account unresolved.
2. Use a VPC security group as the organization boundary is stateful network filtering for delegated administration. The scenario requires central administration, so this alternative is insufficient. Use Organizations integration and a delegated administration or aggregation model for AWS Config addresses security operations account within this Organizations scenario. By comparison, Use a VPC security group as the organization boundary leaves multi-account Config data unresolved.
3. Use Organizations integration and a delegated administration or aggregation model for AWS Config is member-account service administration for delegated administration, matching security operations account. It supports centralize AWS Config organization compliance through Organizations-integrated aggregation and delegated administration. With multi-account Config data also required, Use Organizations integration and a delegated administration or aggregation model for AWS Config is the appropriate AWS Config control.
4. Attach FullAWSAccess SCP to every account is organization-wide permission ceilings for delegated administration. The scenario requires security operations account, so this alternative is insufficient. Use Organizations integration and a delegated administration or aggregation model for AWS Config addresses multi-account Config data within this Organizations scenario. By comparison, Attach FullAWSAccess SCP to every account leaves central administration unresolved.

 

Question 19

A new enterprise wants AWS to establish a governed multi-account foundation with organization structure, centralized logging/security baselines, and a managed landing-zone lifecycle. Which service is the primary fit?

1. AWS Artifact
2. AWS Control Tower landing zone
3. AWS RAM resource share
4. Amazon Route 53 Resolver

Correct Answer(s)

 

B

Rationale

1. AWS Artifact is compliance-report retrieval for landing zone. The scenario requires governance baseline, so this alternative is insufficient. AWS Control Tower landing zone addresses central logging and security within this multi-account scenario. By comparison, AWS Artifact leaves new multi-account foundation unresolved.
2. AWS Control Tower landing zone is managed multi-account governance for landing zone, matching new multi-account foundation. It supports establish the multi-account governance foundation with an AWS Control Tower landing zone. With governance baseline also required, AWS Control Tower landing zone is the appropriate Control Tower control.
3. AWS RAM resource share is managed cross-account resource sharing for landing zone. The scenario requires central logging and security, so this alternative is insufficient. AWS Control Tower landing zone addresses new multi-account foundation within this multi-account scenario. By comparison, AWS RAM resource share leaves governance baseline unresolved.
4. Amazon Route 53 Resolver is hybrid DNS resolution for landing zone. The scenario requires new multi-account foundation, so this alternative is insufficient. AWS Control Tower landing zone addresses governance baseline within this multi-account scenario. By comparison, Amazon Route 53 Resolver leaves central logging and security unresolved.

 

Question 20

A parent OU has a preventive Control Tower control and a detective control. A new nested child OU is created. Which statement best reflects current nested-OU behavior?

1. Preventive controls inherit, while detective controls need separate enablement for the nested OU
2. Neither control type can apply to nested OUs
3. Detective controls inherit but preventive controls never do
4. Both control types always inherit automatically

Correct Answer(s)

 

A

Rationale

1. Preventive controls inherit, while detective controls need separate enablement for the nested OU is policy-based operation prevention for nested OU, matching nested child OU. It supports distinguish nested-OU control inheritance by inheriting preventive controls while enabling detective controls separately. With preventive and detective controls also required, Preventive controls inherit, while detective controls need separate enablement for the nested OU is the appropriate Control Tower control.
2. Neither control type can apply to nested OUs is organizational-unit hierarchy behavior for nested OU. The scenario requires preventive and detective controls, so this alternative is insufficient. Preventive controls inherit, while detective controls need separate enablement for the nested OU addresses current Control Tower behavior within this control inheritance scenario. By comparison, Neither control type can apply to nested OUs leaves nested child OU unresolved.
3. Detective controls inherit but preventive controls never do is policy-based operation prevention for nested OU. The scenario requires current Control Tower behavior, so this alternative is insufficient. Preventive controls inherit, while detective controls need separate enablement for the nested OU addresses nested child OU within this control inheritance scenario. By comparison, Detective controls inherit but preventive controls never do leaves preventive and detective controls unresolved.
4. Both control types always inherit automatically is Control Tower inheritance behavior for nested OU. The scenario requires nested child OU, so this alternative is insufficient. Preventive controls inherit, while detective controls need separate enablement for the nested OU addresses preventive and detective controls within this control inheritance scenario. By comparison, Both control types always inherit automatically leaves current Control Tower behavior unresolved.

• < Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 2
• Amazon AWS SAA-C03 VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints Practice Test 1 >