Exam AWS Certified DevOps Engineer - Professional DOP-C02 All Questions

View all questions & answers for the AWS Certified DevOps Engineer - Professional DOP-C02 exam

Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 174 discussion

Exam question from Amazon's AWS Certified DevOps Engineer - Professional DOP-C02

Question #: 174
Topic #: 1

[All AWS Certified DevOps Engineer - Professional DOP-C02 Questions]

A company uses AWS Organizations to manage its AWS accounts. The company has a root OU that has a child OU. The root OU has an SCP that allows all actions on all resources. The child OU has an SCP that allows all actions for Amazon DynamoDB and AWS Lambda, and denies all other actions.

The company has an AWS account that is named vendor-data in the child OU. A DevOps engineer has an IAM user that is attached to the Administrator Access IAM policy in the vendor-data account. The DevOps engineer attempts to launch an Amazon EC2 instance in the vendor-data account but receives an access denied error.

Which change should the DevOps engineer make to launch the EC2 instance in the vendor-data account?

A. Attach the AmazonEC2FullAccess IAM policy to the IAM user.
B. Create a new SCP that allows all actions for Amazon EC2. Attach the SCP to the vendor-data account.
C. Update the SCP in the child OU to allow all actions for Amazon EC2.
D. Create a new SCP that allows all actions for Amazon EC2. Attach the SCP to the root OU.

Show Suggested Answer

Suggested Answer: C 🗳️

by csG13 at Dec. 29, 2023, 7:07 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

ericphl

Highly Voted 11 months, 1 week ago

Selected Answer: B

I vote B. can't understand why B is not correct answer. SCP can be attached to account. For the C, it is possible. but the potential risk is it's not only allow all EC2 action on "vendor-data" account, but also allow all EC2 actions in other account under the child OU. which is not a best practice.

upvoted 7 times

Srikantha

3 months ago

Deny takes precedence

upvoted 1 times

...

csG13

Highly Voted 1 year, 6 months ago

Selected Answer: C

It's C - Allow must be explicit from root all the way down to the account level. Since it's not specified in the OU the only way to make it available to vendor-account is to change the OU policy.

upvoted 5 times

...

Srikantha

Most Recent 3 months ago

Selected Answer: C

This ensures that IAM policies in the vendor-data account can grant EC2 permissions, resolving the issue.

upvoted 1 times

...

Abilash2605

10 months, 2 weeks ago

Answer is C. You can attach SCP to vendor-data account. however there is deny rule at OU level and that will apply and without updating that your SCP at vendor data account is not useful. As the account will inherit SCP applied at OU.

upvoted 2 times

...

auxwww

10 months, 3 weeks ago

Selected Answer: C

B - Incorrect IMO - The question doesn't ask about taking away anything currently allowed in the existing SCP

upvoted 1 times

...

c3518fc

1 year, 2 months ago

Selected Answer: C

By updating the SCP in the child OU to allow all actions for Amazon EC2, the DevOps engineer can grant the necessary permissions to launch EC2 instances in the vendor-data account while maintaining the desired restrictions for other services and accounts within the child OU.

upvoted 3 times

...

dkp

1 year, 2 months ago

Selected Answer: C

answer is C

upvoted 3 times

...

WhyIronMan

1 year, 3 months ago

Selected Answer: C

C, details are everything during an investigation

upvoted 2 times

...

stoy123

1 year, 3 months ago

Selected Answer: B

B is the correct answer!!!!

upvoted 2 times

stoy123

1 year, 3 months ago

Edit: C is correct

upvoted 2 times

...

DanShone

1 year, 3 months ago

Selected Answer: C

C is correct

upvoted 2 times

...

thanhnv142

1 year, 4 months ago

Selected Answer: C

C is correct: A: We need to modify SCP not IAM policy B: SCP is attached to OUs, not account D: This option changes nothing, as the roout OU has already allowed all actions

upvoted 3 times