DOP-C02 · Question #366
A company uses an organization in AWS Organizations to manage multiple AWS accounts in a hierarchical structure. An SCP that is associated with the organization root allows IAM users to be created…
The correct answer is C. Create an IAM permissions policy named PermissionBoundaries within each account. Configure E. Create an IAM permissions policy named DeveloperBoundary within each account. Configure the. Explanation Options C and E work together to implement a permissions boundary solution: Option C creates a PermissionBoundaries IAM policy that restricts what permissions can be granted to new IAM users, and Option E creates a DeveloperBoundary policy that forces developers…
Question
A company uses an organization in AWS Organizations to manage multiple AWS accounts in a hierarchical structure. An SCP that is associated with the organization root allows IAM users to be created. A DevOps team must be able to create IAM users with any level of permissions. Developers must also be able to create IAM users. However, developers must not be able to grant new IAM users excessive permissions. The developers have the CreateAndManageUsers role in each account. The DevOps team must be able to prevent other users from creating IAM users. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate an SCP in the organization to deny users the ability to create and modify IAM users.
- BCreate an SCP in the organization to grant users that have the DeveloperBoundary policy
- CCreate an IAM permissions policy named PermissionBoundaries within each account. Configure
- DCreate an IAM permissions policy named PermissionBoundaries within each account. Configure
- ECreate an IAM permissions policy named DeveloperBoundary within each account. Configure the
How the community answered
(31 responses)- A6% (2)
- B10% (3)
- C81% (25)
- D3% (1)
Explanation
Explanation
Options C and E work together to implement a permissions boundary solution: Option C creates a PermissionBoundaries IAM policy that restricts what permissions can be granted to new IAM users, and Option E creates a DeveloperBoundary policy that forces developers (via their CreateAndManageUsers role) to always attach PermissionBoundaries as a boundary when creating new users - preventing privilege escalation while still allowing the DevOps team full flexibility.
Why the distractors fail:
- Option A is too blunt - denying all users the ability to create IAM users would block developers entirely, which contradicts the requirement that developers can create IAM users
- Option B is incorrect because SCPs cannot directly grant permissions; they only restrict what IAM policies can allow, and granting via SCP is not how AWS Organizations controls work
- Option D is a near-duplicate/distractor of C - the distinction matters in the actual exam wording, and typically D lacks the critical condition of enforcing the boundary requirement on the developer role
Memory Tip: Think of permissions boundaries as a "ceiling installer" rule - developers can build rooms (create users) but must install a ceiling (attach the boundary policy) that caps how high permissions can go. SCPs control the whole building code, while boundaries control individual room heights.
Topics
Community Discussion
No community discussion yet for this question.