SCS-C03 practice question: Organization policies (SCPs, RCPs, declarative policies, AI opt-out)
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A public university stores student records in two AWS Regions in the European Union, because of a national data residency law. The university runs many departmental accounts under one organization, and the central IT team wants to stop anyone from creating resources in other Regions.
Some global services must still work from any account, including IAM, AWS Organizations, Route 53, and CloudFront. The rule must apply to department administrators too, who can edit the IAM roles in their own accounts.
Which solution meets these requirements?
Choose one answer.
AA. Attach an SCP that denies all actions when aws:RequestedRegion is not one of the two EU Regions, with a NotAction list that exempts global services such as IAM, Organizations, Route 53, and CloudFront.
BB. Attach an SCP that denies all actions when aws:RequestedRegion is not one of the two EU Regions, with no exceptions for any service. Global services can then be used from the approved Regions only, which keeps the rule simple.
CC. Replace the FullAWSAccess SCP on the organization root with an allow list that permits actions only in the two EU Regions. Global services are then reachable from those Regions, and department administrators keep their roles.
DD. Write an IAM policy in each department administrator role that denies actions outside the two EU Regions, and have the central team review those policies each quarter. Each department keeps its own copy of the rule to maintain.
Show the answer and explanation
Answer: A
A. Right: Correct. The SCP blocks regional requests outside the approved Regions for every principal in member accounts, including administrators who edit IAM. The NotAction list keeps global services working, since their calls are not tied to one Region. Learn more: Example SCPs for Region restriction (opens in a new tab)
B. Wrong: With no exceptions, calls to IAM, Route 53, and CloudFront are denied, so administrators cannot manage roles or DNS. The rule is simple, but it breaks day-to-day work in every account.
C. Wrong: An allow list without global service exemptions has the same gap as a blanket deny, so IAM and Route 53 calls fail. Removing FullAWSAccess also changes every account, which the central team did not intend.
D. Wrong: Role policies are edited by the same administrators they are meant to restrict, so they can remove the deny. The control must apply to all administrators, and it cannot depend on who edits a role.
Explanation
An SCP with a Region condition and a NotAction list for global services blocks regional actions outside the approved Regions, even for account administrators. Blanket denies and allow lists without exemptions break global services. Deny policies written into each role can be edited by the same administrators they are meant to restrict.
Want more on Organization policies (SCPs, RCPs, declarative policies, AI opt-out)? The 5 full-length practice sets have 5 more Organization policies (SCPs, RCPs, declarative policies, AI opt-out) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →