Exam AWS-SysOps topic 1 question 650 discussion

B is the correct answer

In this scenario, you can create an OU specifically for the production accounts and apply a restrictive SCP that whitelists only the certified services. This ensures that only the approved services are allowed within the production environment. On the other hand, for the development accounts, you can apply a less restrictive SCP or no SCP at all. This allows developers to experiment with uncertified services without hindrance. This approach minimizes administrative overhead as it provides centralized control through SCPs at the OU level. It ensures that the desired services are restricted in production accounts while allowing flexibility in the development accounts.

B looks good as it matches LEAST administrative overhead

Correct Answer: B

B is the answer

B. Apply service control policies to the AWS Organizational Unit (OU) containing the production accounts to whitelist certified services. Apply a less restrictive policy to the OUs containing the development accounts.

I'll go with B

B. Apply service control policies to the AWS Organizational Unit (OU) containing the production accounts to whitelist certified services. Apply a less restrictive policy to the OUs containing the development accounts.

B is the answer, whitelisting is easier to do. everything else is blacklisted due to implicit deny principle.

Ans B is correct

B is the answer

should it be A?