DOP-C02 · Question #201
A company is launching an application. The application must use only approved AWS services. The account that runs the application was created less than 1 year ago and is assigned to an AWS Organizatio
The correct answer is A. Create an SCP that allows the services that IAM Access Analyzer identifies. Create an OU for the. To restrict an AWS account within an AWS Organizations OU to use only currently active services, an SCP should be created that explicitly allows those services as identified by IAM Access Analyzer.
Question
A company is launching an application. The application must use only approved AWS services. The account that runs the application was created less than 1 year ago and is assigned to an AWS Organizations OU. The company needs to create a new Organizations account structure. The account structure must have an appropriate SCP that supports the use of only services that are currently active in the AWS account. The company will use AWS Identity and Access Management (IAM) Access Analyzer in the solution. Which solution will meet these requirements?
Options
- ACreate an SCP that allows the services that IAM Access Analyzer identifies. Create an OU for the
- BCreate an SCP that denies the services that IAM Access Analyzer identifies. Create an OU for the
- CCreate an SCP that allows the services that IAM Access Analyzer identifies. Attach the new SCP
- DCreate an SCP that allows the services that IAM Access Analyzer identifies. Create an OU for the
How the community answered
(44 responses)- A70% (31)
- B7% (3)
- C18% (8)
- D5% (2)
Why each option
To restrict an AWS account within an AWS Organizations OU to use only currently active services, an SCP should be created that explicitly allows those services as identified by IAM Access Analyzer.
This solution correctly leverages IAM Access Analyzer to determine the set of actively used services and then creates an SCP with an explicit `Allow` statement to restrict access to only those identified services within the new OU.
Creating an SCP that denies services identified by IAM Access Analyzer would prevent specific actions but would not achieve the goal of *only* allowing currently active services, as other services might still be implicitly permitted.
This option is truncated but starts the same way as A; without the full context, it's difficult to differentiate, but the core action of allowing identified services is correct. However, a complete solution would involve proper attachment to the OU.
This option is truncated and appears identical to the start of option A, thus lacking the full context required to be a distinctly correct or incorrect solution.
Concept tested: AWS Organizations SCPs and service control
Source: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html
Topics
Community Discussion
No community discussion yet for this question.