SAP-C02 · Question #172
A company wants to allow its Marketing team to perform SQL queries on customer records to identify market segments. The data is spread across hundreds of files. The records must be encrypted in…
The correct answer is B. Apply a service control policy (SCP) that denies access to all services except IAM, Amazon. According to below, the default configuration of AWS Organizations supports using SCPs as deny https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_strate gies.html#orgs_policies_denylist
Question
A company wants to allow its Marketing team to perform SQL queries on customer records to identify market segments. The data is spread across hundreds of files. The records must be encrypted in transit and at rest. The Team Manager must have the ability to manage users and groups, but no team members should have access to services or resources not required for the SQL queries. Additionally, Administrators need to audit the queries made and receive notifications when a query violates rules defined by the Security team. AWS Organizations has been used to create a new account and an AWS IAM user with administrator permissions for the Team Manager. Which design meets these requirements?
Options
- AApply a service control policy (SCP) that allows access to IAM, Amazon RDS, and AWS
- BApply a service control policy (SCP) that denies access to all services except IAM, Amazon
- CApply a service control policy (SCP) that denies access to all services except IAM, Amazon
- DApply a service control policy (SCP) that allows access to IAM, Amazon Athena, Amazon S3, and
How the community answered
(41 responses)- A7% (3)
- B51% (21)
- C29% (12)
- D12% (5)
Explanation
According to below, the default configuration of AWS Organizations supports using SCPs as deny https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_strate gies.html#orgs_policies_denylist
Community Discussion
No community discussion yet for this question.