DOP-C02 · Question #175
A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full a
The correct answer is B. Ensure that the FullAWSAccess SCP is applied at the organization root. E. Create an SCP that denies IAM related actions with a condition to exclude the management IAM. Explanation Why B and E are correct: Option B ensures the FullAWSAccess SCP is applied at the organization root, which is the default AWS Control Tower behavior and provides the baseline "allow all" permissions that SCPs can then restrict. Option E creates a deny SCP for IAM-rela
Question
A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications. The DevOps team needs to allow only a specific management IAM role to manage the IAM roles and policies of any AWS accounts in only the production OU. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate an SCP that denies full access with a condition to exclude the management IAM role for
- BEnsure that the FullAWSAccess SCP is applied at the organization root.
- CCreate an SCP that allows IAM related actions. Attach the SCP to the development OU.
- DCreate an SCP that denies IAM related actions with a condition to exclude the management IAM
- ECreate an SCP that denies IAM related actions with a condition to exclude the management IAM
How the community answered
(24 responses)- A8% (2)
- B67% (16)
- C21% (5)
- D4% (1)
Explanation
Explanation
Why B and E are correct: Option B ensures the FullAWSAccess SCP is applied at the organization root, which is the default AWS Control Tower behavior and provides the baseline "allow all" permissions that SCPs can then restrict. Option E creates a deny SCP for IAM-related actions with a condition that excludes (exempts) the specific management IAM role, then attaches it to the production OU - this ensures only that designated role can manage IAM in production accounts while blocking everyone else.
Why the distractors are wrong: Option A denies full access rather than specifically targeting IAM-related actions, making it too broad and potentially breaking other workflows. Option C uses an allow SCP on the development OU, which is the wrong OU and wrong approach - SCPs don't grant permissions, they only restrict them, and the goal is to lock down production. Option D is essentially a duplicate/incomplete version of E (the answer choices appear truncated), but E is the correctly scoped version attached to the production OU.
Memory Tip: Think "Deny + Exclude + Correct OU" - when you need to restrict everyone except a specific role, always use a deny SCP with a NotPrincipal/condition exclusion, applied to the target OU (production), not the parent or sibling OUs. SCPs are guardrails that restrict; they never grant permissions.
Topics
Community Discussion
No community discussion yet for this question.