Exam AWS Certified Solutions Architect - Professional topic 1 question 911 discussion

Agree A and D

A and D, for those asking why not D: consolidated billing features DOES NOT include SCP, and All Features (which is the default option) Includes consolidated Billing Features and SCP.

By putting all the accounts into an organization using AWS Organizations allows the solution architect to centrally manage and apply policies across all accounts. By using Service Control policies (SCP) to deny access to the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action, it will enforce the new process across all the accounts. This will ensure that the only way to purchase or modify reserved instances is by following the centralized procurement process, and no one can do it autonomously anymore. It's more secure than using Config, as Config is used for monitoring and auditing rather than enforcement, and it's less secure than using IAM policies, as IAM policies only control the access of users and roles that are attached to it, but SCPs are more comprehensive and can affect all the services across accounts.

B and C will be very painful to administer "hundreds of accounts" E - Options in E are covered under A "all features enabled" Leaving A and D as the remaining options. - By deploying an SCP, this will ensure new accounts also have policies applied automatically.

A&D "enabling all features makes it possible to use SCPs, be sure that your account administrators understand the effects of attaching SCPs to the organization, organizational units, or accounts. SCPs can restrict what users and even administrators can do in affected accounts." https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html

AD correct