Exam AWS Certified Security - Specialty topic 1 question 7 discussion

Correct is C A is incorrect. organization root includes every user/group account in every account B is incorrect. Correct, may be a Identity-based policy applied to the root user on each account D is incorrect. This will not modify user's access or permission Applying a "Control Policy" in your organization. A policy applied to: 1) root applies to all accounts in the organization 2) OU applies to all accounts in the OU and to any child OUs 3) account applies to one account only Note- this requires that Acquirements: -all features are enabled for the organization in AWS Organizations -Only service control policy (SCP) are supported https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html

The Correct Answer is C

C is correct Create an organizational unit (OU) in Organizations with a service control policy that controls usage of the root user. Add all operational accounts to the new OU.

We can used OU's and service control policies to provision the appropriate amount of permissions for your accounts.

C - Seems like the best answer

SCPs can do this job in multi-account environment.....C is the way

https://docs.aws.amazon.com/organizations/latest/userguide/best-practices_member-acct.html#best-practices_mbr-acct_scp

Ans: C 100%

My vote is also for C

Ans > C

Ans (C) Becuase Service Control Policy are available only in an organization that has all features enabled. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Correct is C. SCPs affect all users and roles in attached accounts, including the root user. The only exceptions are those described in Tasks and entities not restricted by SCPs. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html IAM policies can not deny a user if such is a root account.

C is the answer IMHO. Interestingly though you can apply an SCP along the chain of the OU hierarchy and have it apply to sub-OUs, as the effective permissions are the union of all the permissions in the SCP hierarchy, plus IAM permissions.

C is correct answer

C ANSWER

Answer: C (as everyone else states) https://docs.amazonaws.cn/en_us/general/latest/gr/root-vs-iam.html "You can only use an AWS Organizations service control policy (SCP) to limit permissions to an account, including the root user, that is a member of an organization or organizational unit (OU)"

C is correct