nerdexam
Amazon

ANS-C01 · Question #225

A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM) in its networking AWS account. The company is using AWS Resource…

The correct answer is B. Create a new SCP in Organizations. Add a condition that denies the CreateVpc and. The objective is to enforce a strict IPAM policy for VPC creation and CIDR association across an AWS Organization, ensuring CIDRs come only from an account's designated IPAM pool.

Submitted by cyberguy42· Mar 6, 2026Network Security, Compliance, and Governance

Question

A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM) in its networking AWS account. The company is using AWS Resource Access Manager (AWS RAM) to share IPAM pools with other AWS accounts. The company has created a top-level pool with a CIDR block of 10.0.0.0/8. For each AWS account, the company has created an IPAM pool within the top-level pool. A network engineer needs to implement a solution to ensure that users in each AWS account cannot create new VPCs. The solution also must prevent users from associating a CIDR block with existing VPCs unless the CIDR block is from the IPAM pool for that account. Which solution will meet these requirements?

Options

  • ACreate a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR
  • BCreate a new SCP in Organizations. Add a condition that denies the CreateVpc and
  • CCreate an AWS Lambda function to check for and delete all VPCs that are not configured to
  • DCreate an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and

How the community answered

(25 responses)
  • A
    8% (2)
  • B
    84% (21)
  • C
    4% (1)
  • D
    4% (1)

Why each option

The objective is to enforce a strict IPAM policy for VPC creation and CIDR association across an AWS Organization, ensuring CIDRs come only from an account's designated IPAM pool.

ACreate a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR

An AWS Config rule can *detect* non-compliant VPCs or CIDR associations *after* they are created, but it does not *prevent* their creation, which is a key requirement.

BCreate a new SCP in Organizations. Add a condition that denies the CreateVpc andCorrect

Creating a Service Control Policy (SCP) in AWS Organizations that denies `ec2:CreateVpc` and `ec2:AssociateVpcCidrBlock` actions, combined with a condition that checks if the requested CIDR block is sourced from the account's specific IPAM pool, is the most effective and scalable way. SCPs enforce permissions across all accounts in an OU or the organization, preventing users from violating the IPAM policy at the API level.

CCreate an AWS Lambda function to check for and delete all VPCs that are not configured to

An AWS Lambda function to check and delete non-compliant VPCs is a reactive solution. The requirement is to *prevent* the actions proactively, and deleting resources can be disruptive.

DCreate an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and

An Amazon EventBridge rule triggered by AWS CloudTrail events for `CreateVpc` and `AssociateVpcCidrBlock` is also a reactive approach, similar to Config rules or Lambda. It can trigger actions *after* the event occurs, but not proactively prevent the event itself.

Concept tested: IPAM enforcement with AWS Organizations SCPs

Source: https://docs.aws.amazon.com/vpc/latest/ipam/use-scps-ipam.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ANS-C01 Practice