Exam AWS Certified Security - Specialty topic 1 question 431 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 431
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS Single Sign-On (AWS SSO). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use AWS SSO to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
B. Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
C. Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
D. For each AWS account, create tailored identity-based policies for AWS SSO. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

Show Suggested Answer

Suggested Answer: C 🗳️

by AdamWest at Nov. 23, 2022, 2:02 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

AdamWest

Highly Voted 2 years, 9 months ago

Selected Answer: C

C - When using organizations and preventing regions SCP is the best practice. IAM rules can do this to but not as effectively.

upvoted 9 times

Enzao

2 years, 2 months ago

NotAction in SCP...

upvoted 1 times

...

kejam

Most Recent 1 year, 9 months ago

Selected Answer: C

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-deny-region

upvoted 1 times

...

pk0619

2 years, 1 month ago

NotAction,Resource, conditions in SCP cannot be used for allow action they can only Deny https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_syntax.html#scp-elements-table

upvoted 1 times

...

milofficial

2 years, 6 months ago

Selected Answer: C

again, cross-account permission stuff -> SCP in at least 90% of all cases

upvoted 4 times

...

D2

2 years, 9 months ago

C is correct

upvoted 2 times

...