Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 351 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02

Question #: 351
Topic #: 1

[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region.

What should a solutions architect do to meet these requirements?

A. Create a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add the account to the company's organization in AWS Organizations. Enforce a tagging policy that denotes Region affinity.
B. Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-east-2. Attach the SCP to the project's account.
C. Create and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign each developer a specific EC2 instance with their name as the tag.
D. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach the policy to the roles and groups that the developers use in the project's account.

Show Suggested Answer

Suggested Answer: D 🗳️

by cypkir at Nov. 22, 2023, 7:29 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

George88

Highly Voted 1 year, 1 month ago

Should be D. Question says "The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT" You need organisation for SCP.

upvoted 14 times

...

trungtd

Most Recent 7 months ago

Selected Answer: D

only possible way

upvoted 1 times

...

svenkata18

7 months, 4 weeks ago

C Why not C as developers has to select only T3.small. why can't we purchase RI with only T3.small

upvoted 1 times

...

Russs99

10 months, 1 week ago

Selected Answer: D

option D is the only answer. the scenario clearly stated the IT team in this project cannot be part of the organization.

upvoted 2 times

...

career360guru

11 months, 4 weeks ago

Selected Answer: D

Option D

upvoted 1 times

...

vibzr2023

11 months, 4 weeks ago

Answer D: Option B: An SCP can manage IAM permissions across an organization, but the project account isn't part of the organization.

upvoted 1 times

...

ayadmawla

1 year ago

Selected Answer: D

SCP can be applied only to those users and roles which are managed by accounts that are part of any organization See: https://digitalcloud.training/aws-scp-mastering-aws-service-control-policies/#:~:text=SCP%20can%20be%20applied%20only,including%20the%20account's%20root%20user.

upvoted 1 times

...