Quick Answer

The answer is Deny, because SCPs use the Deny effect to explicitly block actions that would otherwise be allowed by default. In AWS Organizations, Service Control Policies (SCPs) operate on an implicit allow model, meaning all actions are permitted unless a Deny statement explicitly overrides them. To prevent users from disabling GuardDuty or modifying its configuration in any member account, a Deny effect must be applied to the relevant GuardDuty API actions, such as StopMonitoringMembers or DisableOrganizationAdminAccount. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this concept tests your understanding of how SCPs enforce security guardrails across accounts, often appearing in scenarios where you must distinguish between identity-based policies and SCPs. A common trap is confusing Allow with Deny—remember that Allow only whitelists actions but does not block anything, while Deny is the only effect that can override the default allow. Memory tip: think of SCPs as a “deny-only” tool—you never write Allow in an SCP to restrict; you always use Deny to block.