DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use service control policies (SCPs) to set permission boundaries.

  Why this is correct

  SCPs are AWS Organizations policies that centrally restrict the maximum permissions for every account in an organization, acting as a guardrail above all IAM policies. They do not grant permissions themselves; instead, they define the effective permission boundary by intersecting with IAM, root user, and resource-based policies. Best practice is to use SCPs to enforce compliance and prevent privilege escalation across accounts, even for the root user.

• ✗

  Share the root user credentials of the master account with administrators.

  Why it's wrong here

  Root user credentials have unrestricted access to all AWS services and billing, including the ability to delete accounts and close support plans. Sharing these credentials across administrators destroys auditability and accountability, bypassing all IAM controls; instead, enable multi-factor authentication on root and delegate administrative tasks via IAM roles.

• ✗

  Use a single IAM user with full permissions across all accounts.

  Why it's wrong here

  Creating a single IAM user with full permissions across accounts provides a shared static credential with no individual accountability, and a single compromised credential grants complete access to all accounts. This directly violates least privilege and separation of duties; AWS recommends separate IAM users with only the permissions each administrator needs, or better, temporary credentials via roles.

• ✓

  Use IAM roles to delegate access to users and services across accounts.

  Why this is correct

  IAM roles issue temporary security credentials via AWS STS, so no long-term secrets are stored or rotated. You can define a trust policy to specify which principals (users, services, or AWS accounts) may assume the role, and an attached permissions policy to limit what they can do, enabling granular cross-account and service access without sharing keys.

• ✓

  Create IAM roles with the principle of least privilege.

  Why this is correct

  By scoping IAM role policies to the minimal actions and resources required for a workload, you reduce the blast radius of a compromised credential. Use conditions, action names, and ARN constraints to further tighten the role policy; such roles are the foundation of a zero-trust security model and help satisfy compliance audits.

Go deeper

Related to this question