SAP-C02 · Question #854
A company is migrating to AWS. The company created a central networking account in an organization in AWS Organizations with all features enabled. The networking account has a VPC that includes a cust
Sign in or unlock SAP-C02 to reveal the answer and full explanation for question #854. The question stem and answer options stay visible for context.
Question
A company is migrating to AWS. The company created a central networking account in an organization in AWS Organizations with all features enabled. The networking account has a VPC that includes a custom firewall appliance. The company configured the inbound routes from the internet to route to the appliance. The company will set up new AWS accounts for the company's migrated services. All the new accounts will share the same new OU. Users of the new accounts will assume IAM roles that have the AdministratorAccess policy. All inbound traffic from the internet in all new accounts must be routed through the central networking account. The company needs a solution that does not deploy an internet gateway into the new accounts. The solution must not allow changes to the route tables for any public subnets. Which solution will meet these requirements?
Options
- ACreate an IAM permissions boundary that blocks access to the CreateInternetGateway action.
- BCreate an SCP that allows only the specific actions that users need in the new accounts.
- CCreate an SCP that blocks the creation and attachment of internet gateways. Assign the SCP to
- DUpdate the IAM roles with an inline policy that adds a Deny statement to block the ReplaceRoute
Unlock SAP-C02 to see the answer
You've previewed enough free SAP-C02 questions. Unlock SAP-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.