Q63 — AWS SAA-C03 Ch.15

Question 63 of 100 | ← Chapter 15

Q1163. A security team uses AWS Organizations to manage multiple AWS accounts.The security team creates one organizational unit(OU) named AI/ML Development for data science accounts. The security team wants to prevent the data science teams from using GPU-based Amazon EC2 instances for development work.Which solution will meet this requirement?

• A. Create a service control policy (SCP) that denies the use of GPU-based EC2 instances. Apply the SCP to the AI/ML Development OU. ✓
• B. Create an IAM permissions boundary policy that denies the use of GPU-based EC2 instances. Apply the permissions boundary to the AI/ML Development OU.
• C. Create an AI services opt-out policy that denies the use of GPU-based EC2 instances.
• D. Create an IAM policy that denies the use of GPU-based EC2 instances. Apply the policy to the organization root.

Correct Answer: A. Create a service control policy (SCP) that denies the use of GPU-based EC2 instances. Apply the SCP to the AI/ML Development OU.

Explanation

The solution that will effectively prevent the data science teams from using GPU-based Amazon EC2 instances is:A. Create a service control policy (SCP) that denies the use of GPU-based EC2 instances. Apply the SCP to the AI/ML Development OU.Service Control Policy (SCP): SCPs are used in AWS Organizations to manage permissions across accounts in an organizational unit. By creating an SCP that specifically denies the use of GPU-based EC2 instances, you can enforce this restriction at the organizational level. Applying to OU: By applying the SCP to the AI/ML Development OU, you ensure that all accounts within that unit are restricted from launching GPU-based instances, aligning with the security team's requirements.This approach is centralized, scalable, and effectively enforces the desired restrictions across the relevant accounts.The solution that will effectively prevent the data science teams from using GPU-based Amazon EC2 instances is:A. Create a service control policy (SCP) that denies the use of GPU-based EC2 instances. Apply the SCP to the AI/ML Development OU.Service Control Policy (SCP): SCPs are used in AWS Organizations to manage permissions across accounts in an organizational unit. By creating an SCP that specifically denies the use of GPU-based EC2 instances, you can enforce this restriction at the organizational level. Applying to OU: By applying the SCP to the AI/ML Development OU, you ensure that all accounts within that unit are restricted from launching GPU-based instances, aligning with the security team's requirements.This approach is centralized, scalable, and effectively enforces the desired restrictions across the relevant accounts.