SCS-C03 practice question: Troubleshooting access denied and policy evaluation
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A media company runs its video encoding team in a member account that sits in the Workloads OU. The OU has a service control policy (SCP) that denies EC2 actions outside three approved Regions, to keep processing in approved locations.
A new GPU project needs instances in ap-southeast-2 from the same account. The team's IAM role already allows ec2:RunInstances, but every launch fails with an explicit deny. Security does not want the other accounts in the OU to gain that Region, and nobody may change the management account.
Which change meets these requirements?
Choose one answer.
AA. Add an Allow statement for ec2:RunInstances in ap-southeast-2 to the encoding team's IAM role. The role policy then grants the access, so the launches succeed without changing any SCP.
BB. Add ap-southeast-2 to the approved Regions in the SCP attached to the Workloads OU. Every account in the OU will then be able to launch instances in that Region, which is the simplest way to fix the problem.
CC. Move the account to a new OU with its own SCP that allows the GPU Region. Keep the existing deny on the Workloads OU for every other account, which then stays restricted.
DD. Attach a new SCP to the encoding account that allows ec2:RunInstances in ap-southeast-2. Because the new policy is attached closer to the account, its allow takes precedence over the deny on the Workloads OU.
Show the answer and explanation
Answer: C
A. Wrong: An IAM allow cannot override an explicit deny in an SCP, so the launches would still fail. SCPs set the outer limit for the account, and only a change to the SCP or to the account placement can lift that limit.
B. Wrong: The change works for this project, but it opens the Region for every account in the OU. Security wants the other accounts to stay restricted, so this option breaks the stated requirement.
C. Right: Correct. Moving the account out of the Workloads OU removes it from that deny, and the new OU SCP can allow the Region for this account alone. Other accounts stay restricted, and the management account is not changed. Learn more: Service control policies evaluation (opens in a new tab)
D. Wrong: SCPs do not take precedence by how close they are to the account. An explicit deny in any SCP on the path from the root to the account still blocks the action, so the inherited deny keeps applying.
Explanation
An explicit deny in any SCP on the path from the root to an account blocks the action, and an IAM allow cannot override it. Moving the account to its own OU with a policy that allows the Region isolates the change to that account. Editing the shared OU policy, or attaching an allow SCP, misses the stated constraints.
Want more on Troubleshooting access denied and policy evaluation? The 5 full-length practice sets have 6 more Troubleshooting access denied and policy evaluation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →