DOP-C02 · Question #160
A company manages multiple AWS accounts in AWS Organizations. The company's security policy states that AWS account root user credentials for member accounts must not be used. The company monitors acc
Sign in or unlock DOP-C02 to reveal the answer and full explanation for question #160. The question stem and answer options stay visible for context.
Question
A company manages multiple AWS accounts in AWS Organizations. The company's security policy states that AWS account root user credentials for member accounts must not be used. The company monitors access to the root user credentials. A recent alert shows that the root user in a member account launched an Amazon EC2 instance. A DevOps engineer must create an SCP at the organization's root level that will prevent the root user in member accounts from making any AWS service API calls. Which SCP will meet these requirements? A. B. C. D.
Exhibit
Options
- A{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "", "Resource": "", "Condition": { "StringNotLike": { "aws:PrincipalArn": "arn:aws:iam:::root" } } } ] }
- B{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "", "Resource": "", "Principal": { "AWS": "arn:aws:iam:::root" } } ] }
- C{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "", "Resource": "", "StringNotLike": { "aws:PrincipalArn": "arn:aws:iam:::root" } } ] }
- D{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "", "Resource": "", "Principal": { "AWS": "arn:aws:iam:::root" } } ] }
Unlock DOP-C02 to see the answer
You've previewed enough free DOP-C02 questions. Unlock DOP-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.