SCS-C02 · Question #140
A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemen
Sign in or unlock SCS-C02 to reveal the answer and full explanation for question #140. The question stem and answer options stay visible for context.
Question
A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts. All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by IAM policies that are defined in the accounts. Which SCP should the security engineer attach to the root of the organization to meet these requirements? A. B. C. D.
Exhibits
Options
- A{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" ], "Resource": "*" } ] }
- B{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ ":,y" ], "Resource": "" }, { "Effect": "Allow", "NotAction": [ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" ], "Resource": "" } ] }
- C{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ":", "Resource": "" }, { "Effect": "Deny", "NotAction": [ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" ], "Resource": "" } ] }
- D{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "NotAction": [ "guardduty:DeleteDetector", "guardduty:UpdateDetector", "securityhub:DisableSecurityHub" ], "Resource": "*" } ] }
Unlock SCS-C02 to see the answer
You've previewed enough free SCS-C02 questions. Unlock SCS-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.