Service Control Policies Quiz

What you'll be asked

1. What is the primary purpose of a Service Control Policy (SCP) in AWS Organizations?
2. If an SCP denies access to a specific service, but an IAM policy explicitly allows it, what is the resulting effective permission?
3. Which of the following is true regarding SCPs applied to the Management (Root) account of an AWS Organization?
4. You want to restrict all member accounts in your organization to only use specific AWS regions. Which policy type should you use?
5. An SCP is attached to an Organizational Unit (OU) with a 'FullAWSAccess' policy. A child OU is created with a new SCP that denies access to Amazon S3. What is the effective permission for an account inside the child OU?

Answers and explanations come after you submit.