SCS-C03 Identity and Access Management Practice Question
A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request will fail because the SCP acts as a filter that restricts the maximum permissions available to any identity in the account.
In AWS IAM evaluation logic, an explicit deny always overrides any allow, regardless of where the deny is defined. Since SCPs act as a guardrail for the entire account, any action denied at the SCP level cannot be performed by any principal within that account, including those with full administrator privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user will successfully create the new IAM user because the administrator policy provides full access that overrides the SCP.
Why it's wrong here
Administrator policies grant broad permissions but they do not bypass the restrictions set by AWS Organizations. SCPs define the maximum available permissions for an account. If an SCP denies an action, no identity-based or resource-based policy can grant that permission back to any user or role in the account.
- ✓
The request will fail because the SCP acts as a filter that restricts the maximum permissions available to any identity in the account.
Why this is correct
Service Control Policies establish the permission boundaries for the entire account. Even if a user has an 'Allow' in their identity-based policy, the lack of an 'Allow' in the SCP or an 'Explicit Deny' in the SCP will result in the action being blocked during the evaluation.
- ✗
The request will succeed only if the user uses the AWS Management Console, but it will fail if they use the AWS CLI or SDK.
Why it's wrong here
IAM permission evaluation is consistent across all access methods, including the Console, CLI, and SDK. AWS does not differentiate between the interface used when enforcing SCPs or identity-based policies. The security context remains the same regardless of the tool used by the principal to make the API call.
- ✗
The request will be sent to the master account for approval before the new IAM user is created in the member account.
Why it's wrong here
AWS Organizations does not provide a built-in manual approval workflow for blocked API calls. If an action is denied by an SCP, the operation is immediately rejected with an 'Access Denied' message. Organizations is an automated policy enforcement tool rather than a request-response management system for administrative tasks.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.