SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM Group in the management account with a region-restrictive policy and add all users to it.

  Why it's wrong here

  IAM Groups are local to a specific AWS account and do not scale across an AWS Organization. Managing users across hundreds of accounts by adding them to a single group in the management account is not feasible and does not prevent root users or new users from creating resources.

• ✓

  Apply a Service Control Policy (SCP) to the organization root that denies all actions if the region is not 'us-east-1' or 'us-west-2'.

  Why this is correct

  SCPs provide central control over the maximum permissions available for all accounts in your organization. By applying the policy at the root, the restriction is inherited by all member accounts, including the root user of those accounts, ensuring consistent compliance with the CISO's regional requirements.

• ✗

  Use AWS Config rules in each account to monitor resource creation and delete any resource found in unauthorized regions.

  Why it's wrong here

  AWS Config is a detective control, meaning it identifies violations after they have occurred. While it can trigger remediation actions like deleting resources, it does not prevent the creation of those resources in the first place, which fails to meet the CISO's requirement for proactive enforcement.

• ✗

  Configure a VPC Endpoint for all services and restrict access to specific regions using VPC Endpoint policies.

  Why it's wrong here

  VPC Endpoint policies control access to services from within a VPC, but they do not prevent users from accessing AWS services through public endpoints or creating resources in other regions via the AWS Console or CLI. This approach is too narrow to enforce a global regional restriction.