Design Solutions for Organizational Complexity26% · 5 topics

Q1. You want to send a large number of files from on-premises servers to S3 over Direct Connect without going through the internet. Which configuration is most appropriate?

1. Create an S3 gateway VPC endpoint and point to it from the on-premises router's route table
2. Create a NAT gateway in the VPC and send on-premises traffic over Direct Connect to the NAT gateway
3. Create an S3 interface VPC endpoint and connect to it from on-premises over Direct Connect
4. Assign public IPs to the on-premises servers and send to the S3 public endpoint over the internet

Q2. VPC A and VPC B are attached to a Transit Gateway, and routes for both are propagated to the Transit Gateway route table. However, EC2 in A cannot reach EC2 in B. What is the most appropriate thing to check next?

1. Whether appliance mode is enabled on the Transit Gateway attachments
2. Whether static routes are also added to the Transit Gateway route table
3. Whether DNS resolution and DNS hostnames are enabled in VPCs A and B
4. Whether A's and B's subnet route tables route the peer CIDR to the Transit Gateway

Q1. You are reviewing the OU structure in AWS Organizations. Which approach best follows AWS recommendations?

1. Group accounts with similar governance needs, such as security, infrastructure and workloads (prod/dev), into the same OU
2. Mirror the company org chart in OUs and move OUs and accounts at every reorganization
3. Put all accounts in one OU and attach SCPs to each account individually
4. Put prod and dev workloads in one account and create no OUs to limit accounts

Q2. Which statement about service control policies (SCPs) is incorrect?

1. Actions explicitly denied by an SCP cannot be performed even if allowed by IAM policies in the member account
2. SCPs do not apply to users and roles in the management account
3. Actions allowed by an SCP can be performed by account users even if no IAM policy allows them
4. SCPs also apply to the root user of member accounts

Q1. Which statement about VPC peering is incorrect?

1. After creating a peering connection, you must add routes to both route tables
2. If A peers with B and B peers with C, A can communicate with C through B
3. VPCs with overlapping CIDRs cannot be peered
4. You can peer with VPCs in different Regions and different accounts

Q2. You want to ensure that CIDRs for new VPCs in all group accounts do not overlap with on-premises or other VPCs. Which method has the least operational overhead?

1. Create address pools in IPAM, allocate CIDRs to organization accounts and monitor for overlaps
2. Record CIDRs in use in a shared spreadsheet, and have whoever creates a VPC check and fill it in manually
3. Use the same 10.0.0.0/16 for all VPCs and translate with NAT when they overlap
4. Let each account's administrator choose CIDRs freely and recreate VPCs later if they overlap

Q1. You want to store API activity records for all accounts in the organization in one place for a long time, in tamper-proof form. Which configuration is most appropriate?

1. Store them in an S3 bucket in the production account and let all employees read the logs through the bucket policy for transparency
2. Have each account administrator download CloudTrail event history as CSV every month and put it in a head-office shared folder by date
3. Create a separate CloudTrail trail in each account and store logs in each account's own S3 bucket
4. Create an organization CloudTrail trail and store logs in an S3 bucket in a log archive account with Object Lock enabled

Q2. Employees authenticate with Microsoft Entra ID. You want to manage access to all accounts with employee identities and automate onboarding and offboarding. Which method is most appropriate?

1. Ask employees at onboarding to set the same password on their IAM user as their Entra ID password
2. Create one shared IAM user per department, share the password within the department and change it periodically
3. Set Entra ID as the identity source for IAM Identity Center and automatically sync users and groups with SCIM
4. Create an IAM user per employee in each account and delete them manually when HR reports a departure

Q1. All accounts are now under Control Tower management. What should you do next to start cost allocation by business unit?

1. Mechanically apportion group-wide costs by each company's sales ratio
2. Standardize tagging with tag policies and activate cost allocation tags
3. Merge all company accounts into one, eliminating business unit distinctions altogether
4. Have Accounting manually transcribe each company's invoice PDFs into a spreadsheet every month

Q2. You are designing organization-wide guardrails. You want to prevent anyone in member accounts, including users with administrator permissions, from stopping or deleting CloudTrail trails. Which mechanism is the most suitable?

1. Resource control policy (RCP)
2. Service control policy (SCP)
3. Organizations tag policy
4. IAM permissions boundary