Q40 — AWS SAA-C03 Ch.16

Question 40 of 100 | ← Chapter 16

Q1240. A company has an organization in AWS Organizations.The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU).There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited typesWhich solutions to deploy the SCP will meet these requirements?(Select TWO.)

• A. Attach the SCP to the root OU for the organization.
• B. Attach the SCP to the three nonproduction Organizations member accounts ✓
• C. Attach the SCP to the Organizations management account.
• D. Create an OU for the production account. Attach the SCP to the OU.Move the production member account into the new OU.
• E. Create an OU for the required accounts. Attach the SCP to the OU.Move the nonproduction member accounts into the new OU. ✓

Correct Answer: B. Attach the SCP to the three nonproduction Organizations member accounts, E. Create an OU for the required accounts. Attach the SCP to the OU.Move the nonproduction member accounts into the new OU.

Explanation

The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts using a Service Control Policy (SCP). SCPs are applied at the OU (Organizational Unit) or account level to restrict AWS service permissions.Key Requirements:The SCP should only apply to nonproduction accounts (not the production account). The SCP must deny access to prohibited EC2 instance types in those accounts.Analysis of Options:A. Attach the SCP to the root OU for the organization.Incorrect: This would apply the SCP to all accounts (including the production account), which violates the requirement to restrict only nonproduction accounts.B. Attach the SCP to the three nonproduction Organizations member accounts. Correct: SCPs can be applied directly to individual accounts. This ensures the policy affects only the nonproduction accounts.C. Attach the SCP to the Organizations management account. Incorrect: The management account (payer account) is not where SCPs are applied to control permissions in member accounts. SCPs are applied to member accounts or OUs, not the management account itself. D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.Incorrect: This would apply the SCP to the production account, which is the opposite of what is required.The SCP should not affect the production account.E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.Correct: This is the recommended approach. By creating an OU for nonproduction accounts and attaching the SCP to it, the policy will apply only to those accounts.Best Solutions:B (Attach SCP directly to nonproduction accounts) ?Works but less scalable if more nonproduction accounts are added later.E (Create an OU for nonproduction accounts and attach SCP) ?More scalable and maintainable, as it groups accounts logically.Final Answer:B and E are the correct solutions.B. Attach the SCP to the three nonproduction Organizations member accounts E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.