SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?
⚠ Common exam trap
It's easy for candidates to confuse SCPs with IAM policies, thinking an IAM policy can be attached to an OU, or they incorrectly assume that an Allow-only SCP is the simplest way to restrict actions, when in reality a targeted Deny SCP is more precise and maintainable for blocking specific modification actions while allowing all other billing read actions by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An SCP that denies the effect of actions that modify billing preferences.
A Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An SCP that allows only read-only billing actions.
Why it's wrong here
SCPs cannot allow actions; they only deny or allow by default.
- ✗
An SCP that denies all billing-related actions except read-only.
Why it's wrong here
This would deny read access as well.
- ✗
An IAM policy attached to the root OU that denies billing modifications.
Why it's wrong here
IAM policies cannot be attached to OUs; they are attached to users/groups/roles.
- ✓
An SCP that denies the effect of actions that modify billing preferences.
Why this is correct
An SCP can deny actions like 'aws-portal:ModifyAccount' and 'aws-portal:ModifyBilling'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.