SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It denies all actions if the request is not made over HTTPS.

This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS. Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It denies all actions if the request is not made over HTTPS.
Why this is correct
The condition aws:SecureTransport false denies non-HTTPS requests.
✗
It denies all actions if the request does not include multi-factor authentication.
Why it's wrong here
The condition checks SecureTransport, not MFA.
✗
It denies all actions from IP addresses outside the corporate network.
Why it's wrong here
No IP condition is present.
✗
It allows all actions as long as the request is made over HTTPS.
Why it's wrong here
This is a Deny policy, not an Allow; it blocks non-HTTPS requests.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question