Correct Answer: Service Control Policy (SCP) at the OU level with a 'Deny' on 's3:CreateBucket' if the encryption condition is not met
SCPs are the most effective way to enforce compliance at the 'API Call' level across multiple accounts in an organization....
Correct Answer
Service Control Policy (SCP) at the OU level with a 'Deny' on 's3:CreateBucket' if the encryption condition is not met
Why This Answer Is Correct
SCPs are the most effective way to enforce compliance at the 'API Call' level across multiple accounts in an organization.
This question evaluates your knowledge of AWS IAM — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS IAM is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
A large enterprise is migrating to AWS and wants to implement a centralized governance model across 100+ AWS accounts. They need to enforce a policy that prevents any account from disabling CloudTrail or deleting S3 buckets that store audit logs. Which solution is most appropriate?
Which AWS service provides an automated way to detect that an EC2 instance in a public subnet has been compromised and is communicating with an known malicious command-and-control server?
An enterprise wants to enforce a rule that all EC2 instances must be launched with a specific set of tags for cost allocation. How can they implement this 'Tagging Enforcement' to prevent non-compliant resources from even being created?
An enterprise wants to migrate its on-premises Microsoft Active Directory to AWS. They want a managed solution that integrates with Amazon RDS for SQL Server and allows them to use their existing AD tools. Which service should they choose?
To improve the security of your AWS environment, you want to identify any IAM roles that have not been used in the last 90 days across all your accounts. Which AWS feature provides this information?