Service Control Policies Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering Multi-Account AWS Environment

What you'll be asked

  1. What is the primary purpose of a Service Control Policy (SCP) in an AWS Organizations environment?
  2. When an SCP is attached to an Organizational Unit (OU), which accounts are affected by the policy?
  3. If an IAM policy grants 's3:*' access but an SCP attached to the account explicitly denies 's3:DeleteBucket', what is the resulting permission?
  4. Which of the following statements is true regarding the 'FullAWSAccess' policy provided by AWS?
  5. You need to prevent accounts within a specific OU from disabling AWS CloudTrail in any region. What is the most effective way to achieve this using SCPs?

Answers and explanations come after you submit.