Hard — SAP-C02 Practice Quiz

Question 1

A company is migrating a 40 TB self-managed MySQL 8.0 database from an on-premises data center to Amazon Aurora MySQL-Compatible Edition. The data center has a 500 Mbps internet connection that is shared with production traffic, and the business requires that ongoing changes be captured and applied so that final cutover downtime is under 15 minutes. The migration team wants to minimize impact on the shared network link during the initial bulk load while still meeting the low-downtime requirement. Which approach best meets these requirements?

Accepted Answer

Export the full database to an AWS Snowball Edge device for the initial bulk load, then use a single AWS DMS task with change data capture (CDC) over the network to replicate ongoing changes until cutover.

Answer

Run a single AWS DMS full-load-plus-CDC task entirely over the existing 500 Mbps internet connection and schedule the full load during a maintenance window.

Answer

Use AWS DataSync to copy the raw MySQL data files to Amazon S3, then restore them directly into Aurora and enable binlog replication for ongoing changes.

Answer

Use AWS Application Migration Service (MGN) to rehost the database server as an EC2 instance, then convert it to Aurora after cutover.

Question 2

A financial services company runs a customer-facing API on Amazon ECS behind an Application Load Balancer. The API calls a downstream third-party payment provider that occasionally becomes slow or unresponsive during peak periods. When the payment provider degrades, threads in the API tier become blocked waiting for responses, cascading failures consume all available connections, and the entire API becomes unavailable — even for endpoints that do not depend on payments. The architecture team must improve resilience so that a slow downstream dependency cannot take down the whole service. Which approach BEST addresses this requirement?

Accepted Answer

Implement a circuit breaker pattern with bulkhead isolation, using separate connection/thread pools per downstream dependency and timeouts, so failures to the payment provider fail fast and are isolated from unrelated endpoints.

Answer

Increase the ECS task count and enable target-tracking auto scaling on CPU utilization so there are always enough tasks to absorb blocked threads during payment provider slowdowns.

Answer

Place an Amazon SQS queue in front of every API endpoint so that all requests are buffered and retried asynchronously until the payment provider recovers.

Answer

Add an Amazon ElastiCache for Redis cluster to cache payment provider responses so that subsequent calls avoid contacting the slow downstream dependency.

Question 3

A financial services company must implement a centralized backup strategy across dozens of AWS accounts for EBS volumes, RDS databases, and DynamoDB tables. Regulatory auditors require that backups be immutable and cannot be deleted or have their retention shortened by anyone — including account administrators and the root user — for a mandatory 7-year retention period. The solution must minimize custom operational tooling and enforce this centrally. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a backup vault protected by AWS Backup Vault Lock in compliance mode, apply a backup plan enforcing the 7-year retention, and orchestrate across accounts using AWS Backup's Organizations integration.

Answer

Enable S3 Object Lock in governance mode on a centralized S3 bucket and write custom Lambda functions to copy all backups into it with a 7-year retention tag.

Answer

Use AWS Backup with a backup vault protected by Vault Lock in governance mode and attach an SCP denying deletion of recovery points.

Answer

Create manual EBS snapshots, RDS snapshots, and DynamoDB backups on a schedule via EventBridge, then apply IAM policies denying delete actions to all users.

Question 4

A retail company runs a self-managed Apache Cassandra cluster on 12 EC2 instances backing its product catalog service. Operations staff spend significant time patching nodes, managing repairs, and scaling the ring during seasonal peaks. Leadership wants to eliminate this operational burden while keeping the existing CQL-based application code changes to an absolute minimum, and they require the migration cutover to complete with less than 5 minutes of write downtime. Which approach best meets these requirements?

Accepted Answer

Migrate to Amazon Keyspaces (for Apache Cassandra) using the CQL COPY command for historical data plus a temporary dual-write from the application to both clusters during cutover, then switch reads to Keyspaces.

Answer

Migrate the data to Amazon DynamoDB using AWS Glue to transform the schema, and rewrite the application to use the DynamoDB SDK.

Answer

Rehost the Cassandra cluster onto larger EC2 instances in an Auto Scaling group and use AWS Backup to reduce the operational effort of the ring.

Answer

Use AWS Database Migration Service (DMS) with a full-load-plus-CDC task to replicate the Cassandra cluster into Amazon Aurora PostgreSQL.

Question 5

A large enterprise runs 120 AWS accounts under AWS Organizations with all features enabled and consolidated billing. The finance team needs to: allocate costs to individual business units (each mapped to a set of accounts), enforce a hard organization-wide spending ceiling that automatically prevents new resource creation when exceeded, and receive proactive alerts before any single account crosses its monthly forecast. The team also wants to maximize Reserved Instance and Savings Plans discount sharing across the organization. Which combination of actions BEST meets these requirements?

Accepted Answer

Use AWS Cost Categories to group accounts into business units, create AWS Budgets with forecasted-cost alerts per account, keep RI/Savings Plans discount sharing enabled in the management account's billing preferences, and apply SCPs to deny resource-creating API calls once a manual review determines the ceiling is reached.

Answer

Enable AWS Budgets Actions to automatically apply a restrictive IAM policy and rely on Budgets to hard-stop all spending organization-wide the instant the ceiling is reached, while disabling RI sharing so each account keeps its own discounts.

Answer

Tag every resource with a business-unit tag, use only the AWS Cost and Usage Report for allocation, and configure a single organization-level budget that terminates running EC2 instances automatically when the ceiling is exceeded.

Answer

Create separate AWS Organizations for each business unit to isolate billing, enable Compute Optimizer for cost allocation, and use Service Quotas to cap spending per account.

Question 6

A company runs a multi-account AWS Organizations environment with dozens of VPCs connected through a central AWS Transit Gateway. An on-premises data center is connected via AWS Direct Connect. The company needs bidirectional DNS resolution: EC2 instances in any VPC must resolve on-premises private hostnames, and on-premises servers must resolve private Route 53 hosted zone records used across the organization. The solution must be centrally managed in a shared networking account and minimize the number of resolver endpoints deployed. Which approach meets these requirements?

Accepted Answer

In the networking account, deploy a Route 53 Resolver inbound endpoint and an outbound endpoint in a central VPC, create resolver rules for the on-premises domain, and share those rules and the private hosted zones across the organization using AWS Resource Access Manager.

Answer

Deploy Route 53 Resolver inbound and outbound endpoints in every VPC across all accounts, and configure conditional forwarding rules independently within each account.

Answer

Configure the on-premises DNS servers to forward all queries to the Amazon-provided VPC resolver at the 169.254.169.253 address over the Direct Connect connection.

Answer

Create a public Route 53 hosted zone for the private domains and use Transit Gateway multicast to distribute DNS records to all VPCs and the on-premises network.

Question 7

A SaaS company runs a high-traffic order-processing service on ECS Fargate. The operations team wants per-customer and per-API-endpoint latency and error metrics so they can build dashboards and alarms broken down by both dimensions. There are roughly 8,000 active customers and 40 API endpoints. The team initially implemented this by calling the CloudWatch PutMetricData API from the application on every request with custom dimensions, but the monthly CloudWatch bill has grown dramatically and the API is being throttled during peak load. Which approach improves cost and reliability while preserving the ability to query metrics by customer and endpoint?

Accepted Answer

Emit structured logs using the CloudWatch Embedded Metric Format (EMF) to stdout, letting CloudWatch Logs asynchronously extract metrics, and use CloudWatch Logs Insights or Contributor Insights for high-cardinality per-customer analysis.

Answer

Continue using PutMetricData but batch up to 1,000 metrics per API call and add exponential backoff to eliminate throttling and reduce cost.

Answer

Create a separate custom CloudWatch metric namespace per customer and publish metrics with PutMetricData to isolate cardinality and reduce charges.

Answer

Send all request telemetry to Amazon Managed Service for Prometheus with per-customer labels and visualize it in Amazon Managed Grafana.

Question 8

A financial services company deploys infrastructure to 40 accounts using AWS CloudFormation StackSets triggered from a central AWS CodePipeline. Recently, engineers have been manually modifying deployed resources in the console during incidents, causing configuration drift that later breaks automated deployments. The platform team wants to continuously detect drift, automatically alert the owning team, and block the pipeline from promoting new changes to any account currently in a drifted state — without manually inspecting each account. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Schedule an EventBridge rule that periodically invokes a Lambda function to call the CloudFormation DetectStackDrift API across accounts, publish drift status to a central store, notify owners via SNS, and add a pipeline stage that fails if any target stack reports DRIFTED before promotion.

Answer

Enable AWS Config in every account with the cloudformation-stack-drift-detection-check managed rule and rely on Config auto-remediation to revert drifted resources, allowing the pipeline to always deploy without additional gating.

Answer

Turn on CloudTrail in all accounts and create a metric filter that alerts whenever an UpdateStack or console modification event occurs, then require engineers to manually re-run drift detection before each release.

Answer

Replace CloudFormation StackSets with Terraform and run terraform plan in the pipeline, treating any non-empty plan as drift and stopping the deployment automatically.

Question 9

A large enterprise recently acquired a smaller company. The acquired company operates 12 standalone AWS accounts that were each created independently with separate root credentials and their own consolidated billing was never enabled. The enterprise already runs a mature AWS Organizations setup managed by AWS Control Tower with several OUs and SCPs. The security team wants these 12 accounts brought under the enterprise Organization so that governance guardrails and centralized billing apply, while minimizing disruption to running production workloads. What is the correct approach to bring these existing accounts under central management?

Accepted Answer

Send an invitation from the management account to each existing account, accept the invitation from each member account, then enroll the accounts into Control Tower by moving them into a registered OU and running the enrollment/update process.

Answer

Recreate each workload in brand-new accounts provisioned by Control Tower Account Factory, migrate the data, and decommission the original 12 accounts since existing accounts cannot join an Organization.

Answer

Use the Control Tower Account Factory to directly import the 12 accounts by supplying their root credentials, which automatically merges them and applies all SCPs immediately.

Answer

Enable consolidated billing by adding the 12 account IDs to the payer account's billing preferences; this automatically joins them to the Organization and applies the enterprise OU guardrails.

Question 10

A large enterprise deployed AWS Control Tower to establish its multi-account landing zone. A platform engineering team, wanting to add a custom deny policy, manually attached a new Service Control Policy directly to a Control Tower-managed Organizational Unit using the AWS Organizations console. Weeks later, the Control Tower dashboard reports the OU and its accounts as 'Not compliant' / drifted, and the team is concerned that a future landing zone update could break their custom guardrail. What is the recommended approach to maintain the custom SCP while keeping Control Tower governance intact?

Accepted Answer

Detach the manually created SCP and re-implement the control as a Control Tower custom guardrail using Customizations for Control Tower (CfCT) or by managing it through Control Tower-supported mechanisms, then re-register the OU to clear drift.

Answer

Leave the SCP attached directly in AWS Organizations and disable Control Tower drift detection so the dashboard stops reporting the OU as non-compliant.

Answer

Remove the OU from Control Tower governance entirely and manage all its accounts manually through AWS Organizations to avoid conflicts with the landing zone.

Answer

Move all accounts out of the drifted OU into the Root so the SCP applies organization-wide and Control Tower no longer manages those accounts.

Question 11

A company runs a data analytics platform in a dedicated 'analytics' account in the us-east-1 Region. A newly acquired subsidiary operates a customer-facing application in a separate 'subsidiary' account in the eu-west-1 Region. Both accounts belong to the same AWS Organization. The analytics team needs the subsidiary application to send periodic batch uploads (a few gigabytes daily) to an internal service running behind an internal Network Load Balancer in the analytics VPC. Both VPCs use overlapping CIDR ranges (10.0.0.0/16). The solution must be private (no traffic over the public internet), minimize ongoing operational overhead, and avoid re-addressing either VPC. Which approach best meets these requirements?

Accepted Answer

Create a VPC endpoint service (AWS PrivateLink) fronting the NLB in the analytics account and create an interface VPC endpoint in the subsidiary VPC that connects to it across accounts and Regions.

Answer

Establish an inter-Region VPC peering connection between the two VPCs and add routes so the subsidiary can reach the NLB directly.

Answer

Attach both VPCs to a Transit Gateway shared via AWS RAM and configure inter-Region Transit Gateway peering to route traffic between them.

Answer

Re-address one of the VPCs to a non-overlapping CIDR, then use VPC peering with static routes to connect the two VPCs privately.

Question 12

A logistics company is migrating a 90 TB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The company's WAN link to AWS is a 500 Mbps connection that is also used for production traffic during business hours, leaving only about 200 Mbps of usable bandwidth for migration. Business rules require the application to remain read-write until a hard 6-hour cutover window on a weekend, during which only minimal downtime is acceptable. The solutions architect must move the bulk data and then apply ongoing changes so the cutover fits within the window. Which approach best meets these requirements?

Accepted Answer

Export the full database to an AWS Snowball Edge device, ship it to AWS to load the bulk data into RDS, and configure an AWS DMS change data capture (CDC) task from the source to keep the target synchronized until the cutover window.

Answer

Run a single AWS DMS full-load task over the existing WAN link, scheduling it to complete before the weekend cutover window and cutting over once the full load finishes.

Answer

Use AWS DataSync to copy the PostgreSQL data files to Amazon S3 over the WAN link, then restore the files directly into the RDS instance during the cutover window.

Answer

Take a native pg_dump during the 6-hour cutover window, transfer the dump file over the WAN link, and restore it into RDS before reopening the application for writes.

Question 13

A company is migrating a 12 TB on-premises PostgreSQL database to Amazon Aurora PostgreSQL using AWS DMS. The source contains several very large tables with columns storing multi-megabyte binary documents (BYTEA / LOB data). The initial full-load task is running extremely slowly and occasionally fails, and the team observes that the LOB-heavy tables are the primary bottleneck. Downtime must be minimized, and the migration must complete reliably. Which approach BEST improves full-load performance and reliability for this workload?

Accepted Answer

Enable DMS limited LOB mode with an appropriately sized max LOB size, split the migration into multiple parallel task threads per table using table-level parallel-load settings, and separate the largest LOB tables into their own DMS tasks.

Answer

Switch the DMS task to full LOB mode with an unlimited LOB size and increase the replication instance to the largest available size to guarantee all LOB data transfers in a single pass.

Answer

Disable LOB migration entirely on the DMS task and use AWS DataSync to copy the binary documents separately after the relational data completes.

Answer

Use AWS Snowball Edge to export the entire database as flat files, then bulk-load into Aurora using pg_restore, bypassing DMS for the LOB tables.

Question 14

A payments company is building a new order-settlement platform. Each account's transactions must be processed in strict chronological order, and duplicate transaction submissions from retrying upstream systems must not be double-processed. Throughput is expected to reach roughly 2,000 transactions per second at peak, spread across hundreds of thousands of distinct account IDs. Multiple independent downstream services (fraud scoring, ledger update, notification) must each receive every transaction. Which architecture best meets ordering, deduplication, and fan-out requirements while scaling elastically?

Accepted Answer

Publish transactions to an SNS FIFO topic using the account ID as the message group ID and the transaction ID as the deduplication ID, fanning out to an SQS FIFO queue per downstream service.

Answer

Publish transactions to a standard SNS topic fanning out to standard SQS queues, and have each consumer sort messages by timestamp and check a DynamoDB table for previously seen transaction IDs.

Answer

Write transactions to a single Kinesis Data Stream with one shard and have each downstream service run its own consumer application reading from the beginning of the stream.

Answer

Send transactions to a single SQS FIFO queue shared by all three downstream services, using the account ID as the message group ID and enabling content-based deduplication.

Question 15

A gaming company is launching a new mobile leaderboard service expected to reach 50 million users across North America, Europe, and Asia. Player scores must be readable with single-digit millisecond latency from any region, and score writes made in one region should become visible in other regions within a couple of seconds. The workload is highly spiky, with traffic surging 20x during tournaments. The team wants a fully managed solution that minimizes operational overhead and scales automatically without pre-provisioning capacity for peak. Which design best meets these requirements?

Accepted Answer

Deploy Amazon DynamoDB global tables in the three regions using on-demand capacity mode, with a DynamoDB Accelerator (DAX) cluster fronting reads in each region.

Answer

Deploy Amazon Aurora MySQL with a global database spanning the three regions and use Aurora Auto Scaling to add read replicas during tournaments.

Answer

Run a self-managed Redis cluster on EC2 in each region with cross-region replication and place it behind an Application Load Balancer.

Answer

Deploy Amazon DynamoDB in a single region with provisioned capacity sized for peak, and use Amazon CloudFront with regional edge caches to serve reads globally.

Question 16

A retail company runs a self-managed Elasticsearch cluster on EC2 that indexes product catalog data. They are migrating to Amazon OpenSearch Service. The catalog is updated continuously by an application that writes to a relational database, and downstream search queries must never return stale results for more than a few minutes during the migration. The migration team wants the lowest-risk cutover with the ability to roll back if the new domain underperforms. Which approach best meets these requirements?

Accepted Answer

Configure the application's indexing pipeline to dual-write to both the self-managed cluster and the OpenSearch domain, backfill historical data via snapshot restore, validate query parity, and cut clients over gradually while keeping the old cluster available for rollback.

Answer

Take a snapshot of the self-managed cluster to Amazon S3, restore it into the OpenSearch domain, then immediately repoint all clients to the new domain and delete the old cluster.

Answer

Use AWS DMS to replicate the Elasticsearch indices directly into the OpenSearch domain with change data capture enabled, then switch clients once replication lag reaches zero.

Answer

Export the indices to CSV, load them into Amazon S3, use AWS Glue to transform the data, and bulk-load into OpenSearch before repointing clients.

Question 17

A retail company runs a monolithic Java order-management application on 40 on-premises VMs. Leadership wants to reduce total cost of ownership over the next 3 years and improve deployment agility, but only has a small team with limited AWS experience and a hard 6-month deadline to exit the data center. The application has tightly coupled modules and a large Oracle database. Which migration approach best balances the deadline, team capacity, and long-term modernization goals?

Accepted Answer

Rehost all VMs with AWS MGN now to meet the deadline, then incrementally refactor the monolith into microservices and replatform the database after the data center exit is complete.

Answer

Refactor the entire monolith into containerized microservices on Amazon ECS and migrate the Oracle database to Aurora PostgreSQL before the data center exit.

Answer

Repurchase by replacing the custom order-management application with a SaaS product and retire the existing codebase within the 6-month window.

Answer

Retain the application on-premises and use AWS Direct Connect to burst compute to AWS until the team gains enough experience to refactor.

Question 18

A media company is designing a new content-processing platform. Every night at 2 AM, a scheduled job must trigger the processing of up to 50,000 newly uploaded articles. Each article requires an independent enrichment task that calls a third-party API with strict rate limits, and processing may take anywhere from 30 seconds to 8 minutes per article. The solution must gracefully handle third-party throttling, automatically retry failed tasks, and be fully managed with minimal operational overhead. The company wants to avoid maintaining any always-on compute. Which architecture best meets these requirements?

Accepted Answer

Use Amazon EventBridge Scheduler to invoke a Lambda function at 2 AM that enqueues one message per article into an Amazon SQS queue, then have Lambda consumers process messages with reserved concurrency to respect the API rate limit, using an SQS dead-letter queue for failed tasks.

Answer

Use a cron job on a persistent Amazon EC2 Auto Scaling group that reads all articles at 2 AM and processes them in parallel threads, retrying failures in application code.

Answer

Use Amazon EventBridge Scheduler to trigger an AWS Batch array job on a large On-Demand compute environment, launching 50,000 concurrent containers that each call the third-party API directly.

Answer

Use an Amazon Kinesis Data Stream fed by a nightly Lambda, with Kinesis Data Firehose delivering records to the third-party API endpoint on a fixed schedule.

Question 19

A gaming company is launching a new mobile title expected to reach millions of concurrent players globally. The backend must record a continuous stream of player score updates and serve near-real-time leaderboard rankings. Write volume is extremely spiky and unpredictable, spiking 20x during tournaments. The team wants a fully managed data store that scales writes seamlessly without capacity planning, delivers single-digit millisecond latency, and minimizes operational overhead. Sorted top-N leaderboard reads must remain fast even at peak. Which design best meets these requirements?

Accepted Answer

Use DynamoDB in on-demand capacity mode for score storage, and place an Amazon ElastiCache for Redis cluster in front to maintain sorted sets for top-N leaderboard queries.

Answer

Deploy an Amazon RDS for PostgreSQL Multi-AZ instance with read replicas and use indexed ORDER BY queries to generate leaderboard rankings.

Answer

Use DynamoDB with provisioned capacity sized to the tournament peak and enable a global secondary index sorted by score for leaderboard reads.

Answer

Store scores in Amazon Aurora Serverless v2 and run windowed ranking queries, scaling Aurora Capacity Units automatically during tournaments.

Question 20

A healthcare SaaS company is building a new patient-records platform on AWS. Regulatory requirements mandate that Protected Health Information (PHI) fields such as Social Security Numbers must be encrypted, but the application must still be able to perform exact-match lookups on these values (for example, to find a patient by SSN) without decrypting the entire dataset. The team wants to minimize the exposure of raw PHI in the primary application database, which runs on Amazon Aurora PostgreSQL. Which design best meets these requirements?

Accepted Answer

Replace raw SSNs with format-preserving tokens generated by a dedicated tokenization service; store the token in Aurora and keep the token-to-value mapping in a separate, tightly access-controlled encrypted vault, indexing on the deterministic token for lookups.

Answer

Enable Aurora storage-level encryption with AWS KMS and store the SSN as a plaintext column, relying on the encrypted volume to satisfy the confidentiality requirement.

Answer

Encrypt each SSN client-side with a randomized AES-GCM key per record before storing it in Aurora, and perform lookups by decrypting all rows in the application layer at query time.

Answer

Store SSNs in Aurora with column-level encryption using a KMS asymmetric key pair, and decrypt values on the database server during each query using a stored procedure.

Question 21

A large enterprise uses AWS IAM Identity Center federated with an external corporate identity provider. The company has 300 AWS accounts organized by business unit and project. As teams grow, the security team is overwhelmed by creating and maintaining separate permission sets for every combination of business unit and project. They want engineers to only access resources tagged with their own business unit, without creating hundreds of unique permission sets. Which approach best meets this requirement with the least ongoing administrative overhead?

Accepted Answer

Configure attribute-based access control (ABAC) in IAM Identity Center by passing identity provider attributes as session tags, and write permission set policies that use condition keys to match those tags against resource tags.

Answer

Create a unique permission set per business unit and assign it to the corresponding accounts, updating the assignments manually whenever a team changes.

Answer

Use a service control policy at each business unit OU that references the user's group membership to restrict access to matching resources.

Answer

Provision individual IAM users in each account with inline policies that grant access based on the user's business unit, synchronized via SCIM.

Question 22

A global enterprise uses AWS IAM Identity Center federated with an external corporate SAML identity provider. The finance team wants to allocate costs of engineer-driven activity in a shared workload account by cost center. Each engineer's IdP profile already contains a 'costCenter' attribute. The security team requires that AWS API calls made through federated sessions carry the engineer's cost center so it can be used both in IAM policy conditions and reflected in AWS CloudTrail for later cost analysis, without creating separate permission sets per cost center. What is the MOST appropriate way to achieve this?

Accepted Answer

Enable attribute-based access control (ABAC) in IAM Identity Center, configure the 'costCenter' attribute to be passed as a session tag from the external IdP, and reference the aws:PrincipalTag/costCenter key in permission set policies.

Answer

Create a separate permission set for each cost center and use SCPs in AWS Organizations to restrict which permission sets can be assumed based on the user's OU membership.

Answer

Configure an AWS Lambda function triggered by CloudTrail to look up each engineer's cost center in the IdP and rewrite the CloudTrail event records with the appropriate cost allocation tag.

Answer

Use AWS Organizations tag policies to enforce a 'costCenter' tag on all resources created in the shared account and rely on AWS Cost Explorer to group spend by that resource tag.

Question 23

A financial services company uses AWS IAM Identity Center (successor to AWS SSO) with permission sets to give engineers console access across 40 accounts in AWS Organizations. A DevOps team now needs programmatic access from an on-premises Jenkins server to deploy into several member accounts. The security team mandates that no long-lived IAM access keys be stored on the Jenkins server, and that all access must be centrally auditable and time-bounded. Which approach best meets these requirements?

Accepted Answer

Configure the Jenkins server to retrieve short-lived credentials from IAM Identity Center by authenticating with the AWS CLI's SSO OIDC device/authorization flow, then assume the permission-set roles in each target account.

Answer

Create an IAM user with access keys in each target member account and store the keys in the Jenkins credential store, rotating them every 90 days.

Answer

Create a single cross-account IAM role in each member account trusting the Jenkins account, and have Jenkins assume it using an IAM user's long-lived keys from a central automation account.

Answer

Deploy an EC2 instance profile on the Jenkins server and use VPC peering so it can call AWS APIs in each member account directly without assuming roles.

Question 24

A financial services company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML identity provider to grant developers access across 40 accounts in AWS Organizations. Each developer receives a permission set that grants broad access to build resources, including full IAM privileges within their assigned workload accounts. A security audit discovers that developers can create new IAM roles and attach the AdministratorAccess policy, effectively escalating their own privileges beyond what the permission set intended. The security team wants to cap the maximum permissions any IAM entity created by developers can ever have, without removing developers' ability to create roles for their applications. Which approach best addresses this requirement?

Accepted Answer

Require that developers, when creating roles, attach a customer-managed permissions boundary policy, and use a permission set inline policy condition that denies role creation unless the approved boundary is set.

Answer

Modify the permission set to remove all IAM write actions, and have a central team provision every application role via a ticketing workflow.

Answer

Attach a service control policy to the workload OU that denies iam:CreateRole and iam:AttachRolePolicy for all principals in those accounts.

Answer

Reduce the permission set session duration to one hour so escalated credentials expire quickly and cannot be reused.

Question 25

A company uses AWS IAM Identity Center (federated to an external corporate IdP) to manage access across 60 accounts in AWS Organizations. Security requires a documented "break-glass" procedure that grants a small group of on-call engineers full administrative access to any account during a Sev-1 incident, even if the corporate IdP is unavailable. Normal daily access must continue to flow through the IdP. The solution must minimize the standing privileged footprint and provide a clear audit trail of when break-glass access is used. Which approach BEST meets these requirements?

Accepted Answer

Create a small number of break-glass IAM roles with AdministratorAccess in each account, trusted only by a locked-down IAM group of native IAM users (not the external IdP) whose credentials are stored in a monitored vault, and use CloudTrail plus EventBridge alarms to alert whenever those roles are assumed.

Answer

Create dedicated IAM users with AdministratorAccess in the management account and share the long-term access keys with the on-call team in a password vault.

Answer

Add an additional Identity Center permission set with AdministratorAccess assigned to the on-call group and rely on the external IdP for authentication during incidents.

Answer

Attach an SCP that grants the on-call engineers administrative privileges only during declared incidents, activating it manually when an incident begins.