SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a service control policy that denies access to the unwanted services and attach it to the development OU.
Tag policies enforce tagging requirements, not service restrictions. Option B is incorrect because modifying the root-level SCP would affect all OUs, not just the development OU. Option C is correct: attaching a deny SCP to the development OU that denies unwanted services will restrict that OU only, as SCPs are inherited but explicit denies override allows. Option D is correct: similarly, an explicit deny SCP attached to the development OU will block those services for that OU. Option E is incorrect because IAM permissions boundaries are applied to IAM principals, not OUs, and do not override SCPs. Therefore, the correct answers are C and D.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a tag policy to the development OU that requires tags for all resources.
Why it's wrong here
Tag policies do not restrict service usage.
- ✗
Modify the root-level SCP to deny the unwanted services.
Why it's wrong here
This would affect all OUs, not just development.
- ✓
Use a service control policy that denies access to the unwanted services and attach it to the development OU.
Why this is correct
Deny SCPs are effective for restricting services.
- ✓
Attach a deny SCP to the development OU that explicitly denies the unwanted services.
Why this is correct
Deny SCPs can be attached to specific OUs to restrict services.
- ✗
Create an IAM permissions boundary for all users in the development OU.
Why it's wrong here
Permissions boundaries do not override SCPs.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.