SAP-C02 Service Control Policies (SCPs) Practice Question
Exhibit
Refer to the exhibit.
$ aws organizations list-accounts
{
"Accounts": [
{
"Id": "111111111111",
"Arn": "arn:aws:organizations::123456789012:account/o-example/111111111111",
"Email": "admin@example.com",
"Name": "ManagementAccount",
"Status": "ACTIVE",
"JoinedMethod": "INVITED",
"JoinedTimestamp": "2024-01-01T00:00:00Z"
},
{
"Id": "222222222222",
"Arn": "arn:aws:organizations::123456789012:account/o-example/222222222222",
"Email": "dev@example.com",
"Name": "DevAccount",
"Status": "ACTIVE",
"JoinedMethod": "CREATED",
"JoinedTimestamp": "2024-01-02T00:00:00Z"
}
]
}A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?
⚠ Common exam trap
The trap is that candidates assume that because the DevAccount has no SCP attached, the root user has full access. However, SCPs are inherited from the root OU, and the management account's SCP denying all actions applies to all accounts in the organization, including the DevAccount.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nothing, because the management account's SCP applies to all accounts.
SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full access to all AWS services because no SCP is applied to the DevAccount.
Why it's wrong here
It assumes the DevAccount is not part of the same organization, but the context indicates it is a member account. SCPs from the root OU apply to all member accounts, so the root user of DevAccount does not have full access.
- ✓
Nothing, because the management account's SCP applies to all accounts.
Why this is correct
As explained above: the management account's SCP applies to all accounts in the organization, denying all actions.
- ✗
Only read-only actions because of default SCP.
Why it's wrong here
There is no 'default SCP' that grants read-only access. SCPs only restrict actions if explicitly defined; here, the only SCP denies all actions.
- ✗
Only actions allowed by the root user's implicit full access.
Why it's wrong here
The root user's implicit full access can be overridden by SCPs. Since the SCP denies all actions, the root user has no effective permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.