Q60 — AWS SAA-C03 Ch.10

Question 60 of 100 | ← Chapter 10

Q660. A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit(OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts.The company has created a service control policy(SCP) to deny access to launch instances that use the prohibited types.Which solutions to deploy the SCP will meet these requirements?(Select TWO.)

• A. Attach the SCP to the root OU for the organization
• B. Attach the SCP to the three nonproduction Organizations member accounts ✓
• C. Attach the SCP to the Organizations management account
• D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU
• E. Create an OU for the required accounts.Attach the SCP to the OU. Move the nonproduction member accounts into the new OU ✓

Correct Answer: B. Attach the SCP to the three nonproduction Organizations member accounts, E. Create an OU for the required accounts.Attach the SCP to the OU. Move the nonproduction member accounts into the new OU

Explanation

The correct solutions to deploy the SCP are: **B. Attach the SCP to the three nonproduction Organizations member accounts.** **E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.** **Explanation:** * **B. Attach the SCP to the three nonproduction Organizations member accounts.** This directly applies the SCP to the specific accounts where you want to restrict EC2 instance launches. This is the most straightforward and targeted approach. * **E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.** This provides a more structured approach by grouping the nonproduction accounts under a dedicated OU. The SCP attached to the OU will then apply to all accounts within that OU. This is beneficial for organization and future management. **Why other options are incorrect:** * **A. Attach the SCP to the root OU for the organization.** This would apply the SCP to all accounts within the organization, including the production account, which is not desired.* **C. Attach the SCP to the Organizations management account.** SCPs attached to the management account apply to all accounts in the organization, including the production account.* **D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.** This would apply the SCP to the production account, which is not the intended outcome. **In summary:** Attaching the SCP directly to the nonproduction accounts (option B) or creating a dedicated OU for nonproduction accounts and attaching the SCP to that OU (option E) are the most effective ways to meet the company's requirements.