Free Preparation Discussions
MENU
Amazon Exam DOP-C02 Topic 5 Question 28 Discussion
Topic #: 5
A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications.
The DevOps team needs to allow only a specific management 1AM role to manage the 1AM roles and policies of any AWS accounts In only the production OU.
Which combination of steps will meet these requirements? {Select TWO.)
You need to understand how SCP inheritance works in AWS. The way it works for Deny policies is different that allow policies.
Allow polices are passing down to children ONLY if they don't have an allow policy.
Deny policies always pass down to children.
That's why there is always an SCP set to the Root to allow everything by default. If you limit this policy, the whole organization will be limited, not matter what other policies are saying for the other OUs. So it's not A. It's not D because it restricts the wrong OU.
Alita
21 days agoElfrieda
22 days agoFernanda
20 hours agoBrock
30 days agoShawn
3 days agoNorah
4 days agoViki
7 days agoArlene
10 days agoChau
1 months agoBrett
12 days agoOlen
22 days agoVi
1 months agoDominque
1 months agoBerry
1 months agoLilli
2 months agoTarra
13 days agoVicky
23 days agoRonnie
28 days agoMaybelle
1 months ago