DOP-C02 Incident and Event Response Practice Question
An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.
A service control policy (SCP) is a feature of AWS Organizations that allows you to centrally control permissions for all accounts in your organization. An SCP can be applied to the root of the organization, an OU, or a specific account. When an SCP that denies all actions is applied to an affected account, it restricts permissions for all principals, including the root user and IAM users in that account. This effectively isolates the compromised account by preventing any API calls. Option A is incorrect because creating a new IAM group with a deny-all policy and adding all users would affect only IAM users, not the root user. Option C is incorrect because an IAM policy attached to IAM users does not affect the root user. Option D is incorrect because applying an SCP that denies all actions only to the root user would leave IAM users unrestricted, failing to fully isolate the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new IAM group with a deny-all policy and add all users to it.
Why it's wrong here
This fails because the root user is not an IAM persona; it cannot be added to an IAM group, and IAM group policies have no effect on root credentials. While an explicit deny group would block listed IAM users, any user omitted from the group, or any IAM role created later, remains unaffected, and the root user retains unrestricted administrative access. An SCP is the only mechanism that can constrain the root user in an organizational unit or account.
- ✓
Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.
Why this is correct
An SCP attached to the affected account or its OU in AWS Organizations acts as a guardrail across every principal in the account, including the account root user and all IAM users and roles. By explicitly denying * , the SCP reduces each principal's effective permissions to an empty set, and because SCPs can only be changed by an administrator in the management account, neither the compromised root user nor any IAM user can detach or bypass the lockdown. This provides full account quarantine, which is exactly what the scenario requires.
- ✗
Attach an IAM policy denying all actions to all IAM users in that account.
Why it's wrong here
This only locks down IAM identities; the root user is not subject to IAM user or group policies and cannot have an IAM policy attached. Because the root user has administrative-level access by default, it would remain fully capable of performing actions in the affected account, including creating new IAM users or modifying the deny policy. To restrict root, an organization-level SCP must be used, as IAM policies alone cannot constrain root credentials.
- ✗
Apply an SCP that denies all actions to the root user only.
Why it's wrong here
This leaves a glaring gap: although the root user is restricted, every IAM user, group permissions, and role still retain their existing allowed actions. In a multi-account organization, an attacker who compromises an IAM user (or the affected account's own operations staff) could continue to perform actions, create new credentials, and exfiltrate data, so the incident response goal of full containment is not met. A comprehensive SCP must target all principals, not only the root user.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.