SOA-C02 · Question #510
A SysOps administrator manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member…
The correct answer is B. Create a service control policy (SCP) in the management account to deny all DynamoDB actions. Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to set permissions across all member accounts in the organization. When you apply an SCP at the root of the organization, it affects all member accounts within that organization. In this scenario…
Question
A SysOps administrator manages policies for many AWS member accounts in an AWS Organizations structure. Administrators on other teams have access to the account root user credentials of the member accounts. The SysOps administrator must prevent all teams, including their administrators, from using Amazon DynamoDB. The solution must not affect the ability of the teams to access other AWS services. Which solution will meet these requirements?
Options
- AIn all member accounts, configure IAM policies that deny access to all DynamoDB resources for
- BCreate a service control policy (SCP) in the management account to deny all DynamoDB actions.
- CIn all member accounts, configure IAM policies that deny AmazonDynamoDBFullAccess to all
- DRemove the default service control policy (SCP) in the management account. Create a
How the community answered
(43 responses)- A9% (4)
- B70% (30)
- C5% (2)
- D16% (7)
Explanation
Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to set permissions across all member accounts in the organization. When you apply an SCP at the root of the organization, it affects all member accounts within that organization. In this scenario, by creating an SCP that denies all DynamoDB actions and applying it to the root of the AWS organization, you effectively block access to Amazon DynamoDB for all users, including the root user, in all member accounts within the organization. This solution prevents any team, including their administrators, from using DynamoDB while still allowing access to other AWS services that are not restricted by the SCP.
Topics
Community Discussion
No community discussion yet for this question.