ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no VPC in any account can have an internet gateway attached. Which option meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.
A service control policy (SCP) applied at the root organizational unit (OU) level can deny the ec2:AttachInternetGateway action across all accounts in the organization. This centrally enforces the restriction. Option A is incorrect because IAM policies are applied per account and do not prevent the action if the user has permissions through other means. Option B is incorrect because security groups control traffic at the instance level, not internet gateway attachments. Option D is incorrect because network ACLs control traffic at the subnet level, not internet gateway attachments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy that denies ec2:AttachInternetGateway and attach it to each account's admin role.
Why it's wrong here
IAM policies are per-account and can be bypassed by users with full admin access.
- ✗
Use security groups to block traffic from internet gateways.
Why it's wrong here
Security groups filter traffic at the instance level, not the VPC level.
- ✓
Apply a service control policy (SCP) that denies ec2:AttachInternetGateway at the root level.
Why this is correct
SCPs centrally control permissions for all accounts in the organization and can deny the action.
- ✗
Use network ACLs to block traffic from internet gateways.
Why it's wrong here
Network ACLs are stateless and can block traffic but do not prevent attachment of internet gateways.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.