SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?
⚠ Common exam trap
Many exam-takers confuse NotAction with a targeted deny, mistakenly thinking it blocks only the specified services, when in fact NotAction denies everything except those services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny effect with ec2:* and rds:* as the actions.
AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny effect with "*" as the action.
Why it's wrong here
This would block all services.
- ✗
Deny effect with NotAction set to ec2:* and rds:*.
Why it's wrong here
This would deny all actions except EC2 and RDS.
- ✗
Allow effect with ec2:* and rds:* as the actions.
Why it's wrong here
SCPs are not grant-based; Allow SCPs are ineffective if there is a Deny elsewhere.
- ✓
Deny effect with ec2:* and rds:* as the actions.
Why this is correct
This denies all EC2 and RDS operations.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.