Exam AWS Certified Solutions Architect - Professional topic 1 question 780 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 780
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company manages multiple AWS accounts by using AWS Organizations. Under the root OU, the company has two OUs: Research and DataOps.
Because of regulatory requirements, all resources that the company deploys in the organization must reside in the ap-northeast-1 Region. Additionally, EC2 instances that the company deploys in the DataOps OU must use a predefined list of instance types.
A solutions architect must implement a solution that applies these restrictions. The solution must maximize operational efficiency and must minimize ongoing maintenance.
Which combination of steps will meet these requirements? (Choose two.)

A. Create an IAM role in one account under the DataOps OU. Use the ec2:InstanceType condition key in an inline policy on the role to restrict access to specific instance type.
B. Create an IAM user in all accounts under the root OU. Use the aws:RequestedRegion condition key in an inline policy on each user to restrict access to all AWS Regions except ap-northeast-1.
C. Create an SCP. Use the aws:RequestedRegion condition key to restrict access to all AWS Regions except ap-northeast-1. Apply the SCP to the root OU.
D. Create an SCP. Use the ec2:Region condition key to restrict access to all AWS Regions except ap-northeast-1. Apply the SCP to the root OU, the DataOps OU, and the Research OU.
E. Create an SCP. Use the ec2:InstanceType condition key to restrict access to specific instance types. Apply the SCP to the DataOps OU.

Show Suggested Answer

Suggested Answer: CE 🗳️

by Firelord at Dec. 30, 2021, 10:36 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

gsaini

Highly Voted 3 years, 5 months ago

C & E should be right answer.

upvoted 8 times

...

Raphaello

Most Recent 1 year, 4 months ago

Selected Answer: CE

Correct answers are C & E

upvoted 1 times

...

janvandermerwer

2 years, 8 months ago

Selected Answer: CE

C - Yes - Apply once to Root OU which will propogate to all accounts "Because of regulatory requirements, ALL resources" E - Yes - Logical remaining answer A - High overhead B - High overhead D - Wrong as you'll need to add the policy multiple times to different OUs, compared to adding once (More operational overhead)

upvoted 1 times

...