ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Organizations with SCPs to restrict access. The security team wants to ensure that no IAM user or role can disable AWS Shield Advanced protections. Which SCP effect should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
(Deny) is correct because the Deny effect in an SCP explicitly prohibits specified actions, overriding any Allow statements in IAM policies. Option A (Deny in IAM policy) is not an SCP effect; SCPs are separate from IAM policies. Option C (Allow) permits actions but does not restrict, so it cannot be used to enforce prohibitions. Option D (Block) is invalid; AWS SCPs use Deny, not Block.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny in the IAM policy
Why it's wrong here
Deny in an IAM policy can be overridden by SCP Allow; SCP Deny is more definitive.
- ✓
Deny
Why this is correct
Deny in an SCP explicitly prohibits the specified actions.
- ✗
Allow
Why it's wrong here
Allow in an SCP does not restrict; it only permits actions.
- ✗
Block
Why it's wrong here
There is no 'Block' effect in AWS SCPs; only Allow and Deny exist.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with SCPs to restrict access. The security team needs to prevent users in the 'Developers' OU from disabling AWS Config or modifying its rules. Which SCP effect should be used?
medium- A.Block
- ✓ B.Deny
- C.Allow
- D.NotAction
Why B: A Deny effect explicitly blocks the action, overriding any Allow. Option A is wrong because Allow would not prevent the action. Option C is wrong because SCPs don't have a Block effect. Option D is wrong because NotAction is a condition element, not an effect.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.