Landing zones, OUs, SCPs and RCPs: SAP-C03 study notes and practice questions
What to know about Landing zones, OUs, SCPs and RCPs for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
These questions describe a growing company, a merger, or a security team that wants rules enforced in every account, and ask how to structure accounts and enforce controls with the least manual work.
Organization structure
Group accounts into OUs by function and policy needs, not by org chart: Security (log archive, audit/security tooling), Infrastructure (networking, shared services), Workloads split into Prod and Non-Prod, Sandbox, Suspended, and a Policy Staging OU for testing guardrails.
One workload per account per environment gives a hard blast radius and clean billing.
Keep the management account for billing and organization administration only; delegate GuardDuty, Security Hub, Config, Identity Center, Backup and others to delegated administrator accounts.
AWS Control Tower
Sets up a landing zone: log archive and audit accounts, an organization CloudTrail trail, Config, and IAM Identity Center.
Controls come in three behaviors: preventive (SCPs and RCPs), detective (Config rules) and proactive (CloudFormation Hooks that block noncompliant resources before creation).
The Region deny control limits which Regions accounts can use.
Account Factory creates accounts with baselines from the console or through automation; Account Factory for Terraform (AFT) runs it as a GitOps pipeline; Account Factory Customization applies blueprints. Existing accounts can be enrolled.
Check drift when someone changes Control Tower resources outside it.
SCPs and RCPs
SCPs set the maximum permissions of principals in member accounts, including the root user, and grant nothing. They don’t apply to the management account or to service-linked roles.
RCPs set the maximum permissions on resources in member accounts, for supported services such as S3, STS, KMS, SQS and Secrets Manager, against any caller, including principals outside the organization.
Effective access is the intersection of SCPs, RCPs, identity policies and resource policies; an explicit deny anywhere wins.
Typical SCPs: deny leaving the organization, deny disabling CloudTrail, Config or GuardDuty, deny unapproved Regions (exempting global services), require a permissions boundary on new roles, protect central roles. Typical RCPs: deny access from outside the organization, require TLS.
Test new policies in a staging OU before attaching to the root.
How to choose
Scenario wording
Pick
New accounts with standard baseline in minutes
Control Tower Account Factory (AFT for Terraform shops)
Block noncompliant resources before they’re created
Proactive controls (CloudFormation Hooks)
No one, including account admins, may disable logging
SCP
No outside principal may read any bucket or key
RCP
Only approved Regions
Control Tower Region deny or SCP with aws:RequestedRegion
Report but don’t block
Detective controls (Config rules)
Common traps
Workloads in the management account, where SCPs and RCPs don’t apply.
Expecting an SCP to restrict outsiders; that’s an RCP’s job.
A Region-deny SCP with no exemptions for global services such as IAM, CloudFront and Route 53.
Manual account creation and per-account scripts when Account Factory automates it.
OUs that mirror departments, which forces duplicate policies.
A car maker's AWS organization has a Workloads OU with two child OUs, Prod and Dev, which hold about 150 accounts. The AWS managed FullAWSAccess SCP is attached to the root, to every OU and to every account.
Accounts in the Dev OU must be able to use only an approved list of 40 services. No workload account may leave the organization or disable Amazon GuardDuty, except through a security administrator role used for incident response.
Prod accounts must keep the access they have today, and new accounts must get the right controls as soon as they are placed in an OU.
Which SCP design meets these requirements?
Choose one answer.
AA. Attach an SCP that allows only the 40 approved services to the Dev OU alongside the existing FullAWSAccess policy, and attach an SCP to the Workloads OU that denies leaving the organization and disabling GuardDuty.
BB. Attach permissions boundaries that allow only the 40 approved services to every IAM role in the Dev accounts, and add an IAM policy in each workload account that denies leaving the organization and disabling GuardDuty.
CC. Remove FullAWSAccess from the root, attach an SCP that allows only the 40 approved services to the Dev OU, and attach a deny SCP to the Workloads OU with an exception for the security role.
DD. Replace FullAWSAccess on the Dev OU with an SCP that allows only the 40 approved services, and attach a deny SCP to the Workloads OU for leaving the organization and disabling GuardDuty, with an aws:PrincipalArn exception for the security role.
Show the answer and explanation
Answer: D
A. Wrong: Allow statements attached at the same level combine, so FullAWSAccess still allows every service and the allow list has no effect. The deny also has no exception for the security administrator role.
B. Wrong: Account administrators can change or remove these IAM controls, and roles created later would not get them automatically. The controls are not enforced by the organization.
C. Wrong: An action must be allowed by an SCP at every level from the root down to the account. With nothing allowed at the root, every account in both OUs loses all permissions, so Prod no longer keeps its current access.
D. Right: Correct. In the Dev OU, the allow list replaces FullAWSAccess, so only the 40 services stay available there while Prod keeps full access. The deny at the Workloads OU reaches every account below it, including new ones, and the principal exception lets the security role act.
Explanation
An SCP allow list takes effect only where it replaces FullAWSAccess, and every level from the root to the account must allow an action. A deny attached at the Workloads OU with a principal exception covers all current and future workload accounts. Keeping FullAWSAccess beside the allow list, removing it at the root, or relying on per-account IAM controls each break a requirement.
A retailer's platform team creates about 25 new AWS accounts a year, one for each new store system. Each account must start with the company's baseline: central logging, approved Regions, a standard VPC and the security guardrails.
Account requests come from a web form, and the business wants a new account ready within an hour. The platform team does not want to script every step from scratch, and accounts that are created must stay compliant afterwards.
Which solution meets these requirements?
Choose one answer.
AA. Enroll the OU in AWS Control Tower, and provision new accounts through Account Factory, using Account Factory customization blueprints to deploy the standard VPC and baseline stacks.
BB. Have an administrator create each account by hand in the Organizations console, then copy the baseline settings from a template account, following a written runbook.
CC. Write a Lambda function that calls the Organizations CreateAccount API when a form is submitted, and move the new account into the correct OU.
DD. Create one shared account for all store systems, and separate the stores with IAM roles, resource tags and dedicated subnets instead of creating a new account for each store system that is requested.
Show the answer and explanation
Answer: A
A. Right: Correct. Account Factory creates accounts with the landing zone's guardrails and logging already in place, and its customizations apply the team's VPC and baseline stacks. Guardrails keep the accounts compliant after creation.
B. Wrong: Manual creation takes far longer than an hour and is prone to missed steps. The accounts would also lack the guardrails and logging that the landing zone enforces.
C. Wrong: The function creates the account, but nothing applies the logging, the Region limits or the VPC. The team would have to build and maintain the entire baseline itself.
D. Wrong: A shared account removes the account boundaries the company wants for each store system, so one system's compromise can reach the others. The design does not give each system its own baseline.
Explanation
Control Tower Account Factory gives the one-hour provisioning, with the landing zone's logging and guardrails already in place and customizations for the VPC and stacks. Manual setup, a bare CreateAccount function and a shared account each miss the baseline or the isolation.
Want more on Landing zones, OUs, SCPs and RCPs? The 5 full-length practice sets have 8 more Landing zones, OUs, SCPs and RCPs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →