SCS-C02 Question #430: Real Exam Question with Answer & Explanation

Question

A company uses AWS Organizations to manage a small number of AWS accounts. However, the company plans to add 1,000 more accounts soon. The company allows only a centralized security team to create IAM roles for all AWS accounts and teams. Application teams submit requests for IAM roles to the security team. The security team has a backlog of IAM role requests and cannot review and provision the IAM roles quickly. The security team must create a process that will allow application teams to provision their own IAM roles. The process must also limit the scope of IAM roles and prevent privilege escalation. Which solution will meet these requirements with the LEAST operational overhead?

Options

• ACreate an IAM group for each application team. Associate policies with each IAM group.
• BDelegate application team leads to provision IAM roles for each team. Conduct a quarterly review
• CPut each AWS account in its own OU. Add an SCP to each OU to grant access to only the AWS
• DCreate an SCP and a permissions boundary for IAM roles. Add the SCP to the root OU so that