AWS Organizations Security Quiz

What you'll be asked

1. What is the primary purpose of an AWS Organizations Service Control Policy (SCP)?
2. An organization has multiple OUs. You need to apply a policy that prevents member accounts from disabling CloudTrail. Where should you attach this policy for maximum coverage and security?
3. Which AWS service, when integrated with AWS Organizations, provides a centralized view of security findings across all member accounts?
4. When using AWS Organizations, what is the function of a 'Delegated Administrator'?
5. You have an SCP that denies 's3:*' for a specific bucket, but an IAM policy in a member account explicitly allows 's3:GetObject'. What is the effective permission for a user in that account?

Answers and explanations come after you submit.