SAP-C02 · Question #204
A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the…
The correct answer is D. Create a temporary OU named Onboarding for the new account. An SCP at a lower level can't add a permission after it is blocked by an SCP at a higher level. SCPs can only filter; they never add permissions. SO you need to create a new OU for the new account assign an SCP, and move the root SCP to Production OU. Then move the new account…
Question
A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services. The company recently acquired a new business unit and invited the new unit's existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company's policies. Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?
Options
- ARemove the organization's root SCPs that limit access to AWS Config.
- BCreate a temporary OU named Onboarding for the new account.
- CConvert the organization's root SCPs from deny list SCPs to allow list SCPs to allow the required
- DCreate a temporary OU named Onboarding for the new account.
How the community answered
(36 responses)- A3% (1)
- B11% (4)
- C17% (6)
- D69% (25)
Explanation
An SCP at a lower level can't add a permission after it is blocked by an SCP at a higher level. SCPs can only filter; they never add permissions. SO you need to create a new OU for the new account assign an SCP, and move the root SCP to Production OU. Then move the new account to production OU when AWS config is done.
Community Discussion
No community discussion yet for this question.