Exam AWS Certified SysOps Administrator - Associate topic 1 question 373 discussion

The answer is B as you have no idea what other SCP policies could be in place and deleting the entire SCP would be bad practice.

Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to set permissions across all member accounts in the organization. When you apply an SCP at the root of the organization, it affects all member accounts within that organization. In this scenario, by creating an SCP that denies all DynamoDB actions and applying it to the root of the AWS organization, you effectively block access to Amazon DynamoDB for all users, including the root user, in all member accounts within the organization. This solution prevents any team, including their administrators, from using DynamoDB while still allowing access to other AWS services that are not restricted by the SCP.

I agree with the explanation of many folks here why B is the correct answer. One thing we must understand is that AWS Organizations attaches an AWS managed SCP named FullAWSAccess to every root, OU and account when it's created. This policy allows all services and actions. Therefore, attaching a new SCP that denies all DynamoDB actions to the root of the organizations makes a lot more sense. This is because we don't care what access other SCPs have granted the Management accounts and OUs, this new SCP explicitly denies DynamoDB related actions. We are good since explicit "deny" overrides explicit "allow". Please refer to this documentation - https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html for more information

Answer: B Service Control Policies (SCPs) are used to manage permissions for all members of an AWS Organization. SCPs allow you to set permissions that restrict actions across the entire organization or specific organizational units (OUs). By creating an SCP that denies all DynamoDB actions and applying it at the root level of the AWS Organization, you can prevent all member accounts, including their administrators with root user credentials, from using Amazon DynamoDB. This solution will not affect the ability of the teams to access other AWS services, as SCPs are used to control permissions for specific services or actions.

I´m not sure, but for me it´s something between B and D, but not C.