SCS-C02 · Question #411
A company that uses AWS Organizations is migrating workloads to AWS. The company's application team determines that the workloads will use Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB…
The correct answer is A. Create CloudFormation templates in an administrator AWS account. Share the stack sets with an D. Use SCPs to prevent the application AWS account from provisioning specific resources unless. A is correct because CloudFormation StackSets, created in a central administrator account, allow you to deploy standardized templates across all member accounts in an AWS Organization - directly satisfying the requirement that all infrastructure must be deployed via…
Question
A company that uses AWS Organizations is migrating workloads to AWS. The company's application team determines that the workloads will use Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For each resource type, the company mandates that deployments must comply with the following requirements:
- All EC2 instances must be launched from approved AWS accounts.
- All DynamoDB tables must be provisioned with a standardized naming
convention.
- All infrastructure that is provisioned in any accounts in the
organization must be deployed by AWS CloudFormation templates. Which combination of steps should the application team take to meet these requirements? (Choose two.)
Options
- ACreate CloudFormation templates in an administrator AWS account. Share the stack sets with an
- BCreate CloudFormation templates in an application AWS account. Share the output with an
- CUse permissions boundaries to prevent the application AWS account from provisioning specific
- DUse SCPs to prevent the application AWS account from provisioning specific resources unless
- EActivate AWS Config managed rules for each service in the application AWS account.
How the community answered
(59 responses)- A64% (38)
- B5% (3)
- C10% (6)
- E20% (12)
Explanation
A is correct because CloudFormation StackSets, created in a central administrator account, allow you to deploy standardized templates across all member accounts in an AWS Organization - directly satisfying the requirement that all infrastructure must be deployed via CloudFormation and enforcing conventions like DynamoDB naming or approved EC2 configurations.
D is correct because SCPs (Service Control Policies) are the proper tool for organization-wide preventive guardrails - you can write an SCP that denies provisioning of EC2, DynamoDB, etc. unless the API call originates from CloudFormation, effectively enforcing the "CloudFormation-only" deployment mandate across every account.
B is wrong because StackSets must originate from an administrator/management account to propagate across the org; creating them in an application account gives you no cross-account authority.
C is wrong because permissions boundaries are scoped to individual IAM principals within a single account - they don't enforce organization-wide policies the way SCPs do.
E is wrong because AWS Config is a detective control (it reports violations after the fact), not a preventive one - it would flag non-compliant resources but not stop them from being created.
Memory tip: Match the control type to the requirement - "SCPs = Stop (preventive, org-wide)" and "StackSets = Spread (deploy CloudFormation at scale across accounts)." If the question asks about enforcing org-wide rules, think SCPs; if it asks about deploying templates centrally, think StackSets.
Topics
Community Discussion
No community discussion yet for this question.