I85PREP
⌘ K
AWS SAP Specialty study materials
AWS SAP Specialty study resources

AWS SAP Specialty practice questions

One question at a time. Build your AWS SAP Specialty understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design Solutions for Organizational Complexity

A company needs a single AWS environment that many separate business units can use while keeping each unit's costs and resources isolated for chargeback. Which AWS construct is designed primarily for this purpose?

  1. A single account with resource tags only
  2. AWS Organizations with multiple member accounts Correct answer.
  3. A single account with multiple VPCs
  4. AWS Control Tower landing zone only

Explanation

AWS Organizations lets you govern many accounts under one root, apply service control policies centrally, and use consolidated billing so each account's spend can be attributed to its owning unit. Separate accounts provide the strongest resource and cost isolation boundary, which is why multi-account structures are the standard pattern for business-unit chargeback.

Question 2Design Solutions for Organizational Complexity

Which AWS Organizations feature is used to centrally restrict which AWS services and actions member accounts can use, regardless of the permissions granted inside those accounts?

  1. Identity-based policies
  2. Resource-based policies
  3. Permission boundaries
  4. Service control policies Correct answer.

Explanation

Service control policies are attached at the organization, OU, or account level and define the maximum permissions available to principals in member accounts. They do not grant permissions; they filter what identity and resource policies inside the account can allow.

Question 3Design Solutions for Organizational Complexity

A platform team wants new accounts to be provisioned with a preconfigured baseline of logging, identity, and network settings automatically. Which combination best meets this requirement?

  1. AWS Control Tower with account factory and guardrails Correct answer.
  2. AWS Config rules in each account only
  3. Manual account creation with a runbook
  4. AWS Trusted Advisor checks in each account

Explanation

Control Tower's account factory provisions new accounts from a customizable template and applies baseline controls, while guardrails enforce preventive and detective policies across the landing zone. This automates a consistent, auditable baseline rather than relying on manual steps.

Question 4Design Solutions for Organizational Complexity

An organization's security policy requires that all API calls in member accounts be recorded and retained for later investigation. Which approach satisfies this centrally?

  1. Enable VPC Flow Logs in each VPC
  2. Enable AWS CloudTrail organization trail delivering to a central log-archive account Correct answer.
  3. Enable AWS Config in each account
  4. Enable CloudTrail event history in each account

Explanation

An organization trail created in the management account applies to all member accounts and can deliver logs to a centralized, restricted S3 bucket in a log-archive account. This gives one tamper-resistant destination for investigation and retention.

Question 5Design Solutions for Organizational Complexity

Which AWS service provides a single place to aggregate findings from GuardDuty, Security Hub, and Inspector across many accounts?

  1. AWS Security Hub with a delegated administrator Correct answer.
  2. AWS Config aggregator
  3. AWS Trusted Advisor
  4. Amazon CloudWatch Logs Insights

Explanation

Security Hub can designate a delegated administrator account that aggregates and manages findings from member accounts and integrated services. Config aggregators aggregate configuration data, not security findings.

Question 6Design Solutions for Organizational Complexity

A company wants to share a centrally managed VPC subnet with several accounts so each account can launch its own resources into it. Which feature should be used?

  1. AWS Transit Gateway
  2. VPC peering
  3. AWS Resource Access Manager VPC sharing Correct answer.
  4. PrivateLink

Explanation

VPC sharing through AWS Resource Access Manager lets a VPC owner share subnets with other accounts, which then create resources in those shared subnets while the owner retains control of the network. This reduces VPC sprawl and centralizes network management.

Question 7Design Solutions for Organizational Complexity

An organization wants to enforce that all S3 buckets in member accounts block public access. Which mechanism provides a preventive control at the organization level?

  1. An AWS Config rule that flags public buckets
  2. An SCP that denies s3:PutBucketPublicAccessBlock changes that would allow public access Correct answer.
  3. A CloudWatch alarm on bucket metrics
  4. A bucket policy in each account

Explanation

Preventive controls are implemented with SCPs that deny the actions required to enable public access, blocking the configuration before it occurs. Detective controls such as Config rules only report after the fact.

Question 8Design Solutions for Organizational Complexity

Which statement best describes how consolidated billing benefits a multi-account organization?

  1. It automatically deletes unused accounts
  2. It combines usage across accounts so volume discounts and reserved capacity are shared Correct answer.
  3. It removes the need for service control policies
  4. It merges all accounts into one IAM namespace

Explanation

Consolidated billing rolls member account usage into one payer account, allowing aggregate volume to reach pricing tiers and letting Savings Plans and Reserved Instances apply across accounts. It does not change identity or governance boundaries.

Question 9Design Solutions for Organizational Complexity

A company with accounts in several OUs wants developers to be able to assume a role in production accounts only during approved change windows. Which design achieves this with least operational effort?

  1. Rely on developers to log out after use
  2. Create individual IAM users in every production account
  3. Use IAM Identity Center permission sets combined with an SCP that denies the role assumption outside approved hours Correct answer.
  4. Issue long-lived access keys to each developer

Explanation

IAM Identity Center centralizes workforce identity and permission sets across accounts, while an SCP using a date/time condition provides a preventive time-window restriction. Together they avoid per-account user management and cannot be bypassed by the developer.

Question 10Design Solutions for Organizational Complexity

A central networking account owns a Transit Gateway. Spoke VPCs in other accounts must connect to it, and the network team wants to control which spokes can communicate. Which combination supports this?

  1. Peer every spoke VPC directly to every other spoke
  2. Attach an internet gateway to each spoke
  3. Use a single shared VPC for all spokes
  4. Share the Transit Gateway with RAM and use Transit Gateway route tables and associations Correct answer.

Explanation

Resource Access Manager shares the Transit Gateway so spoke accounts can attach their VPCs, and Transit Gateway route tables and associations let the network team segment which spokes can reach each other. This centralizes routing policy in the owning account.

Question 11Design Solutions for Organizational Complexity

An organization requires that member accounts cannot leave the organization and cannot disable CloudTrail. Which two controls are appropriate? (Choose the best single answer.)

  1. A permission boundary and a bucket policy
  2. A Trusted Advisor check and a budget alert
  3. A Config rule and a CloudWatch alarm
  4. An SCP denying organizations:LeaveOrganization and cloudtrail:StopLogging Correct answer.

Explanation

SCPs are the preventive mechanism for denying specific actions across member accounts, including leaving the organization and stopping the trail. Detective tools like Config or alarms would only report the action after it happened.

Question 12Design Solutions for Organizational Complexity

A company wants each business unit to manage its own AWS accounts but the central cloud team must retain the ability to apply guardrails. How should the organization be structured?

  1. Give each business unit its own separate AWS Organizations
  2. Let each unit create standalone accounts outside the organization
  3. Put all accounts in a single OU with no SCPs
  4. Create OUs per business unit and delegate account creation while keeping SCPs at the organization root and OU level Correct answer.

Explanation

OUs allow the central team to attach SCPs that inherit down to all accounts in the unit while delegating day-to-day account management. Keeping all units inside one organization preserves consolidated governance and billing.

Question 13Design Solutions for Organizational Complexity

A security team needs to detect anomalous behavior and malware across all accounts with minimal per-account configuration. Which service should be enabled organization-wide with a delegated administrator?

  1. AWS Config
  2. Amazon Inspector
  3. AWS CloudTrail
  4. Amazon GuardDuty Correct answer.

Explanation

GuardDuty can be enabled across an organization from a delegated administrator, automatically enrolling new accounts and aggregating findings centrally. It provides threat detection without per-account agent deployment.

Question 14Design Solutions for Organizational Complexity

A company wants cross-account access to an S3 bucket owned by a data account, with access granted to roles in many consumer accounts. Which approach is most maintainable?

  1. A bucket policy granting access to specific role ARNs or to an organization ID condition Correct answer.
  2. Replicating the bucket into every consumer account
  3. Making the bucket public and relying on obscurity
  4. Sharing long-term access keys with each consumer

Explanation

A resource-based bucket policy can grant cross-account access to role principals and can use an aws:PrincipalOrgID condition to allow all accounts in the organization without listing each one. This avoids credential sharing and duplication.

Question 15Design Solutions for Organizational Complexity

An organization wants a central log-archive account whose S3 bucket cannot be modified or deleted by member accounts or even by most administrators. Which design elements are required?

  1. Lifecycle rules to transition to Glacier
  2. Server-side encryption with a customer key only
  3. Versioning only
  4. A bucket policy restricting writes to the organization trail, S3 Object Lock, and an SCP preventing policy changes Correct answer.

Explanation

Immutability requires combining a bucket policy that limits who can write, S3 Object Lock for write-once retention, and an SCP that prevents disabling or altering the controls. Encryption and versioning alone do not prevent deletion or tampering.

Question 16Design Solutions for Organizational Complexity

A multinational company must keep data in specific countries and route workloads accordingly. Which AWS construct best supports this requirement at the account level?

  1. Using a single account in one Region for all workloads
  2. Organizing accounts by Region and applying SCPs that restrict Regions where resources can be created Correct answer.
  3. Relying on tags to indicate data residency
  4. Enabling CloudTrail in all Regions

Explanation

Grouping accounts by geography and using SCPs with aws:RequestedRegion conditions prevents resource creation outside approved Regions, providing a preventive data-residency control. Tags and logging are descriptive or detective and do not enforce residency.

Question 17Design Solutions for Organizational Complexity

A company uses AWS Control Tower and wants to detect drift from its landing zone baseline. Which capability addresses this?

  1. Control Tower drift detection and notification Correct answer.
  2. AWS Support plans
  3. Amazon CloudWatch dashboards
  4. AWS Budgets alerts

Explanation

Control Tower continuously monitors the landing zone and detects drift in its managed resources, notifying administrators so the baseline can be remediated. Budgets, dashboards, and support plans do not detect landing-zone drift.

Question 18Design Solutions for Organizational Complexity

A central team wants to provide a self-service catalog of approved infrastructure templates to all accounts, with versioning and sharing across the organization. Which service fits best?

  1. AWS Marketplace subscriptions
  2. AWS Service Catalog with portfolios shared through AWS Organizations Correct answer.
  3. AWS Config conformance packs
  4. AWS CloudFormation StackSets only

Explanation

Service Catalog lets a central team curate approved products into portfolios and share them with accounts or OUs via Organizations, giving governed self-service with version control. StackSets deploys stacks but does not provide a curated catalog experience.

Question 19Design Solutions for Organizational Complexity

An organization has hundreds of accounts and wants to deploy a baseline IAM role into every current and future account automatically. Which approach is most appropriate?

  1. A Lambda function triggered per account creation only
  2. A script run manually against each account
  3. A bucket policy granting access to all accounts
  4. CloudFormation StackSets with service-managed permissions targeting the organization Correct answer.

Explanation

StackSets with service-managed permissions can deploy stacks to an entire organization or selected OUs and automatically include new accounts as they are added. This scales without manual per-account execution.

Question 20Design Solutions for Organizational Complexity

A company needs workloads in two accounts to communicate privately without traversing the public internet, and the security team wants centralized inspection of that traffic. Which design meets both needs?

  1. Use AWS PrivateLink between the two VPCs
  2. Create a VPC peering connection directly between the two VPCs
  3. Use an internet gateway in each VPC
  4. Attach both VPCs to a shared Transit Gateway and route traffic through a central inspection VPC Correct answer.

Explanation

A Transit Gateway with a central inspection VPC lets spokes route inter-VPC traffic through security appliances using route table segmentation, achieving private connectivity and centralized inspection. Direct peering bypasses the inspection point.

Question 21Design Solutions for Organizational Complexity

An enterprise wants to enforce that only approved AMIs and instance types can be launched in all accounts, while still allowing teams to self-serve. Which combination is most effective?

  1. An SCP denying ec2:RunInstances unless conditions match approved values Correct answer.
  2. A Trusted Advisor check for instance limits
  3. A Config rule reporting noncompliant instances
  4. A CloudWatch dashboard showing instance types

Explanation

An SCP with condition keys on RunInstances can prevent launches that do not match approved AMI or instance type values, enforcing the standard before resources exist. Detective reporting only flags violations after launch.

Question 22Design Solutions for Organizational Complexity

A company wants to centrally manage DNS so that all accounts' private hosted zones resolve consistently across a shared network. Which approach is appropriate?

  1. Use public hosted zones for internal names
  2. Rely on each account's default resolver
  3. Create identical private hosted zones in every account
  4. Create a central private hosted zone in a shared-services account and associate VPCs from other accounts using RAM or association Correct answer.

Explanation

A central private hosted zone can be associated with VPCs in other accounts, giving consistent internal resolution while centralizing record management. Duplicating zones per account risks drift and inconsistent answers.

Question 23Design Solutions for Organizational Complexity

An organization wants to give a third-party auditor read-only access to compliance evidence across all accounts without creating users in each account. Which design is best?

  1. Make the evidence buckets public
  2. Share root credentials with the auditor
  3. Create an auditor role in a central account and use cross-account role chaining with SCPs and permission sets Correct answer.
  4. Create an IAM user in every account for the auditor

Explanation

A central auditor role with cross-account trust and scoped read permissions lets the auditor access evidence without per-account identities, and SCPs ensure the access cannot be broadened. This preserves least privilege and auditability.

Question 24Design Solutions for Organizational Complexity

A company wants to separate production and non-production workloads so that production changes require additional approval and cannot be altered by developers. Which organizational design supports this?

  1. Place production accounts in a dedicated OU with stricter SCPs and change-management controls Correct answer.
  2. Give developers administrator access in production
  3. Place all accounts in one OU with identical policies
  4. Use tags to mark production resources

Explanation

Separate OUs allow stricter SCPs and change controls to apply only to production accounts, creating a technical boundary that developers cannot bypass. Identical policies or tags do not enforce separation.

Question 25Design Solutions for Organizational Complexity

Which AWS service should be used to centrally manage and rotate secrets used by applications across many accounts?

  1. AWS Secrets Manager with cross-account resource policies Correct answer.
  2. A shared spreadsheet of credentials
  3. Environment variables in code
  4. AWS Systems Manager Parameter Store plaintext parameters

Explanation

Secrets Manager supports automatic rotation and resource policies that allow cross-account access to secrets, centralizing secret management. Plaintext parameters, environment variables, and spreadsheets lack rotation and access control.

Question 26Design Solutions for Organizational Complexity

A solutions architect needs a single AWS account structure in which every new account automatically receives the same baseline IAM roles and CloudTrail configuration. Which combination of AWS services should be used?

  1. AWS Control Tower with account factory and lifecycle events that trigger automated provisioning Correct answer.
  2. AWS IAM Identity Center with permission sets assigned to all users
  3. AWS Organizations with service control policies applied at the root only
  4. AWS Config with an aggregator across every Region

Explanation

Control Tower's account factory provisions new accounts through a standardized template and emits lifecycle events that automation can use to apply baselines. Service control policies only set permission guardrails and do not deploy resources.

Question 27Design Solutions for Organizational Complexity

Which AWS Organizations feature lets a management account apply an explicit deny guardrail that even the account root user in a member account cannot override?

  1. Service control policy Correct answer.
  2. Session policy
  3. IAM permissions boundary
  4. Resource-based policy

Explanation

SCPs define the maximum permissions available to principals in member accounts and apply to the root user as well, unless the SCP itself grants the action. Permissions boundaries and session policies only constrain individual IAM principals inside one account.

Question 28Design Solutions for Organizational Complexity

A company wants a single invoice and volume discounts across 40 AWS accounts. Which action should the solutions architect take?

  1. Attach the same SCP to all accounts
  2. Enable AWS Cost Explorer in each account and share reports manually
  3. Create a consolidated billing family by inviting all accounts into one AWS Organization Correct answer.
  4. Link every account to a single IAM Identity Center instance

Explanation

Consolidated billing within AWS Organizations combines usage for tiered pricing and produces one payer invoice. Cost Explorer sharing and SCP attachment do not affect billing aggregation.

Question 29Design Solutions for Organizational Complexity

A central security account must read CloudTrail logs written to an S3 bucket in a log-archive account. Which configuration establishes this access?

  1. Add a bucket policy in the log-archive account granting the security account's role, and grant the role sts:AssumeRole in its own account Correct answer.
  2. Replicate the bucket to the security account using Cross-Region Replication
  3. Enable S3 Transfer Acceleration on the log bucket
  4. Attach an SCP to the security account allowing s3:GetObject

Explanation

Cross-account S3 access requires a resource-based bucket policy in the owning account that names the external principal, plus identity permissions in the caller's account. Replication copies objects but does not grant read access to the source.

Question 30Design Solutions for Organizational Complexity

Which AWS service provides a centralized, queryable record of API activity across all accounts in an organization when configured as an organization trail?

  1. Amazon CloudWatch Logs Insights
  2. Amazon GuardDuty
  3. AWS CloudTrail Correct answer.
  4. AWS Config

Explanation

An organization trail logs management events from every member account into a single destination bucket and log group. CloudWatch Logs Insights queries logs but does not collect API activity by itself.

Question 31Design Solutions for Organizational Complexity

A company wants developers to sign in once and access role-based permissions in 30 accounts. Which service should the solutions architect recommend?

  1. AWS Secrets Manager
  2. AWS IAM Identity Center Correct answer.
  3. Amazon Cognito user pools
  4. AWS Directory Service for Microsoft AD

Explanation

IAM Identity Center provides a single sign-in portal and assigns permission sets that map to roles across organization accounts. Cognito is for customer-facing application identities, and Secrets Manager stores secrets.

Question 32Design Solutions for Organizational Complexity

An organization has business units that each need to create accounts but must not be able to move accounts out of their assigned OU. Which approach meets this requirement?

  1. Delegate account creation by creating a dedicated member account per business unit and granting it organizations:CreateAccount and MoveAccount scoped to its OU Correct answer.
  2. Enable all features in Organizations and share the root credentials
  3. Use AWS Config rules to revert account moves
  4. Give each business unit an IAM user in the management account

Explanation

AWS Organizations supports delegated administration, letting a member account create accounts and move them only within the OU paths granted by policy. The management account should not issue credentials to business units.

Question 33Design Solutions for Organizational Complexity

A solutions architect must ensure that member accounts cannot create internet-facing Application Load Balancers in an OU used for regulated workloads. Which mechanism enforces this at scale?

  1. An SCP on the OU denying elasticloadbalancing:CreateLoadBalancer when the scheme is internet-facing Correct answer.
  2. A security group rule denying inbound traffic from 0.0.0.0/0
  3. An IAM permissions boundary attached to each developer role
  4. A bucket policy on the shared log bucket

Explanation

SCPs can use condition keys such as elasticloadbalancing:Scheme to deny specific configurations across every principal in the OU. Permissions boundaries apply per role and can be bypassed by other principals in the account.

Question 34Design Solutions for Organizational Complexity

A company wants to centralize VPC networking so that all account VPCs can reach a shared inspection VPC without creating many peering connections. Which design should the solutions architect choose?

  1. AWS PrivateLink endpoints in each VPC for every service
  2. A Transit Gateway shared from a central networking account using AWS RAM, with all VPCs attached Correct answer.
  3. A single VPC with all workloads in one account
  4. Full-mesh VPC peering between every pair of VPCs

Explanation

Transit Gateway acts as a regional hub, and sharing it with AWS RAM lets participant accounts attach their VPCs without per-pair peering. Full-mesh peering scales poorly and PrivateLink only exposes specific services.

Question 35Design Solutions for Organizational Complexity

A solutions architect needs to give a partner account temporary, auditable access to specific resources in a production account. Which approach follows best practice?

  1. Create a cross-account role in the production account with a trust policy scoped to the partner account and an external ID, and require MFA Correct answer.
  2. Create an IAM user in the production account and email the access key to the partner
  3. Share the production account root credentials over a secure channel
  4. Add the partner's IAM users directly to a production IAM group

Explanation

Cross-account roles with scoped trust policies and external IDs provide temporary credentials that are logged and revocable. Long-term IAM users and shared root credentials create unmanageable standing access.

Question 36Design Solutions for Organizational Complexity

A company wants to apply a tag policy that prevents accounts from launching resources without a CostCenter tag. Which service enforces the tag values?

  1. AWS Budgets with an alert threshold
  2. AWS Cost Anomaly Detection
  3. AWS Trusted Advisor checks
  4. AWS Tag Policies in AWS Organizations combined with SCPs that deny untagged resource creation Correct answer.

Explanation

Tag policies standardize tag keys and values, and SCPs can deny creation of resources that lack required tags. Budgets and anomaly detection only report on cost after resources exist.

Question 37Design Solutions for Organizational Complexity

A solutions architect must ensure that all accounts send AWS Config data to a central account for compliance reporting. Which configuration achieves this?

  1. Use AWS Health Dashboard to monitor compliance in all accounts
  2. Enable Config in each account and create an aggregator in the central account that collects data from organization accounts Correct answer.
  3. Enable CloudTrail in each account and query it from the central account
  4. Create a CloudWatch dashboard in the central account

Explanation

A Config aggregator in a delegated administrator or central account can collect configuration and compliance data from all organization accounts. CloudTrail records API calls but not resource compliance state.

Question 38Design Solutions for Organizational Complexity

A company wants to prevent any member account from deleting the central CloudTrail trail or its log bucket. Which combination of controls should be used?

  1. Versioning on the log bucket alone
  2. MFA delete enabled on the log bucket
  3. A bucket policy in the log account that denies deletion and an SCP denying cloudtrail:StopLogging and cloudtrail:DeleteTrail in member accounts Correct answer.
  4. CloudTrail log file validation

Explanation

Protecting the destination requires denying destructive S3 actions in the bucket policy, while an SCP prevents member accounts from stopping or deleting the trail. Versioning and log file validation support integrity but do not block the actions.

Question 39Design Solutions for Organizational Complexity

An organization wants to give a central team the ability to view costs for all accounts but not to change any resources. Which approach meets this requirement?

  1. Share the root credentials of the management account with the team
  2. Grant the team AdministratorAccess in the management account
  3. Create a role in the management account with read-only Billing and Cost Management permissions and have the team assume it Correct answer.
  4. Add the team to an IAM group in each member account with PowerUserAccess

Explanation

Billing data for the organization lives in the management account, so a scoped read-only role there provides visibility without resource change rights. Administrator and PowerUser access exceed the requirement.

Question 40Design Solutions for Organizational Complexity

A company needs to enforce that EC2 instances in all accounts can only be launched with approved AMIs. Which service should the solutions architect use?

  1. SCPs with a condition on ec2:ImageId combined with an AWS Organizations managed policy Correct answer.
  2. AWS Shield Advanced
  3. Security groups restricting outbound traffic
  4. AWS Config rules with automatic remediation only

Explanation

An SCP can deny RunInstances unless the AMI ID matches an approved list, which enforces the rule before the instance exists. Config rules detect violations after the fact and depend on remediation.

Question 41Design Solutions for Organizational Complexity

A company wants a central DNS design where private hosted zones created in a shared services account resolve from VPCs in many workload accounts. Which configuration should be used?

  1. Use public hosted zones for all internal names
  2. Create the private hosted zone in the shared services account and associate the workload VPCs with it using AWS RAM or cross-account association Correct answer.
  3. Create a private hosted zone in each workload account and duplicate records
  4. Rely on VPC peering alone for name resolution

Explanation

A single private hosted zone in a central account can be associated with VPCs in other accounts, giving consistent resolution without duplicating records. Public zones would expose internal names, and peering does not provide DNS resolution by itself.

Question 42Design Solutions for Organizational Complexity

A solutions architect must let an external auditor read compliance evidence from a central account without creating IAM users. Which design is appropriate?

  1. Make the evidence bucket public with a random prefix
  2. Add the auditor's users to a group in the central account
  3. Create a cross-account role with a trust policy limited to the auditor's account and an external ID, granting read-only access to the evidence bucket Correct answer.
  4. Issue long-term access keys to the auditor

Explanation

A scoped cross-account role with an external ID gives the auditor temporary credentials and produces an auditable trail. Public buckets and long-term keys create unacceptable exposure.

Question 43Design Solutions for Organizational Complexity

A company wants to separate production and non-production workloads so that changes to production require approval by a central team. Which organizational design supports this?

  1. Use a single OU for all accounts with identical SCPs
  2. Place production and non-production accounts in separate OUs with different SCPs and use AWS Control Tower account factory with a change management pipeline Correct answer.
  3. Put all workloads in one account and use tags to separate them
  4. Give every developer AdministratorAccess in production

Explanation

Separate OUs let the organization apply stricter guardrails and approval gates to production accounts while allowing faster iteration in non-production. A single account or uniform OU removes the separation the requirement demands.

Question 44Design Solutions for Organizational Complexity

A company wants to centrally manage and rotate database credentials used by applications in many accounts. Which service should the solutions architect recommend?

  1. Environment variables baked into AMIs
  2. AWS Systems Manager Parameter Store with plaintext values
  3. AWS KMS customer managed keys stored in application code
  4. AWS Secrets Manager with a central secret replicated to workload accounts and automatic rotation Correct answer.

Explanation

Secrets Manager supports automatic rotation and cross-account replication of secrets so applications in many accounts consume centrally managed credentials. Parameter Store plaintext, AMI variables, and embedded keys lack rotation and expose secrets.

Question 45Design Solutions for Organizational Complexity

A company has 200 accounts and wants to detect drift from its landing zone baseline after manual changes. Which capability should the solutions architect use?

  1. AWS Control Tower drift detection with notifications and automated remediation Correct answer.
  2. AWS Budgets alerts
  3. Amazon Inspector findings
  4. AWS Trusted Advisor cost checks

Explanation

Control Tower detects drift from the landing zone baseline and can notify or remediate through lifecycle events. Inspector, Trusted Advisor, and Budgets address different concerns.

Question 46Design Solutions for Organizational Complexity

A solutions architect must design a multi-account architecture where a central team can approve infrastructure templates and distribute versioned updates to all accounts. Which service should be used?

  1. AWS Config conformance packs
  2. AWS CloudFormation StackSets with no approval process
  3. AWS Systems Manager State Manager
  4. AWS Service Catalog with a portfolio shared through AWS RAM to organization accounts Correct answer.

Explanation

Service Catalog lets a central team curate approved products and share portfolios with accounts through AWS RAM, giving controlled, versioned self-service. StackSets deploy templates but do not provide the curated catalog and approval workflow.

Question 47Design Solutions for Organizational Complexity

A company needs workloads in two accounts to communicate privately, and the security team requires that traffic between them be inspected by a central firewall VPC. Which design meets these requirements?

  1. VPC peering directly between the two workload VPCs
  2. Attach both workload VPCs and the inspection VPC to a shared Transit Gateway, and route traffic through the inspection VPC Correct answer.
  3. Use an internet gateway with security groups
  4. Use AWS PrivateLink between the two VPCs

Explanation

Transit Gateway centralizes routing so traffic between workload VPCs can be steered through an inspection VPC with a firewall appliance. Direct peering bypasses inspection, and PrivateLink only exposes specific endpoints.

Question 48Design Solutions for Organizational Complexity

A company wants to enforce that member accounts cannot disable GuardDuty or delete its detectors. Which control should be applied?

  1. An SCP denying guardduty:DeleteDetector, guardduty:DisassociateFromAdministratorAccount, and guardduty:UpdateDetector in member accounts Correct answer.
  2. Enabling GuardDuty in each account manually
  3. A CloudWatch alarm on GuardDuty findings
  4. A bucket policy on the GuardDuty export bucket

Explanation

An SCP that denies the destructive GuardDuty actions prevents member accounts from disabling the service or detaching from the delegated administrator. Alarms and manual enablement do not prevent the actions.

Question 49Design Solutions for Organizational Complexity

An organization wants to give a central network team the ability to create and share Transit Gateway attachments across accounts while preventing member accounts from attaching VPCs outside approved OUs. Which combination should be used?

  1. Granting AdministratorAccess to the network team in every account
  2. AWS RAM sharing of the Transit Gateway with an OU and an SCP denying ec2:CreateTransitGatewayVpcAttachment outside the approved account list Correct answer.
  3. Using VPC peering instead of a Transit Gateway
  4. Sharing the Transit Gateway with the entire organization and relying on IAM policies in each account

Explanation

Sharing with an OU through AWS RAM limits which accounts can use the gateway, and an SCP with a condition on the requesting account enforces the approved list. Organization-wide sharing without guardrails or broad administrator access removes the restriction.

Question 50Design Solutions for Organizational Complexity

A company wants to consolidate security findings from GuardDuty, Security Hub, and Inspector across all accounts into one view. Which design should the solutions architect use?

  1. Use AWS Config aggregators only
  2. Forward all findings to a single CloudWatch log group manually
  3. Enable AWS Security Hub with a delegated administrator account and organization-wide aggregation Correct answer.
  4. Enable Trusted Advisor in each account

Explanation

Security Hub supports a delegated administrator and organization-wide aggregation so findings from integrated services appear in one place. Config aggregators track configuration, and manual log forwarding does not normalize findings.