SAP-C03 practice question: Landing zones, OUs, SCPs and RCPs (1 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker's AWS organization has a Workloads OU with two child OUs, Prod and Dev, which hold about 150 accounts. The AWS managed FullAWSAccess SCP is attached to the root, to every OU and to every account.
Accounts in the Dev OU must be able to use only an approved list of 40 services. No workload account may leave the organization or disable Amazon GuardDuty, except through a security administrator role used for incident response.
Prod accounts must keep the access they have today, and new accounts must get the right controls as soon as they are placed in an OU.
Which SCP design meets these requirements?
Choose one answer.
AA. Attach an SCP that allows only the 40 approved services to the Dev OU alongside the existing FullAWSAccess policy, and attach an SCP to the Workloads OU that denies leaving the organization and disabling GuardDuty.
BB. Attach permissions boundaries that allow only the 40 approved services to every IAM role in the Dev accounts, and add an IAM policy in each workload account that denies leaving the organization and disabling GuardDuty.
CC. Remove FullAWSAccess from the root, attach an SCP that allows only the 40 approved services to the Dev OU, and attach a deny SCP to the Workloads OU with an exception for the security role.
DD. Replace FullAWSAccess on the Dev OU with an SCP that allows only the 40 approved services, and attach a deny SCP to the Workloads OU for leaving the organization and disabling GuardDuty, with an aws:PrincipalArn exception for the security role.
Show the answer and explanation
Answer: D
A. Wrong: Allow statements attached at the same level combine, so FullAWSAccess still allows every service and the allow list has no effect. The deny also has no exception for the security administrator role.
B. Wrong: Account administrators can change or remove these IAM controls, and roles created later would not get them automatically. The controls are not enforced by the organization.
C. Wrong: An action must be allowed by an SCP at every level from the root down to the account. With nothing allowed at the root, every account in both OUs loses all permissions, so Prod no longer keeps its current access.
D. Right: Correct. In the Dev OU, the allow list replaces FullAWSAccess, so only the 40 services stay available there while Prod keeps full access. The deny at the Workloads OU reaches every account below it, including new ones, and the principal exception lets the security role act.
Explanation
An SCP allow list takes effect only where it replaces FullAWSAccess, and every level from the root to the account must allow an action. A deny attached at the Workloads OU with a principal exception covers all current and future workload accounts. Keeping FullAWSAccess beside the allow list, removing it at the root, or relying on per-account IAM controls each break a requirement.
Want more on Landing zones, OUs, SCPs and RCPs? The 5 full-length practice sets have 8 more Landing zones, OUs, SCPs and RCPs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →