SCS-C03 Identity and Access Management Practice Question
A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SCPs affect all users and roles in the member account, including the account's root user.
SCPs are a key component of AWS Organizations for implementing guardrails across multiple accounts. They do not grant permissions but define the maximum available permissions for IAM users and roles within the targeted accounts. Understanding how SCPs interact with identity-based and resource-based policies is essential for maintaining a secure and compliant multi-account environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SCPs can grant permissions to an IAM user that hasn't been given access by an identity-based policy.
Why it's wrong here
SCPs are strictly filters and cannot grant permissions. Even if an SCP allows an action, the IAM user or role must still be granted that permission through an identity-based policy or a resource-based policy to actually perform the action within the member account.
- ✓
SCPs affect all users and roles in the member account, including the account's root user.
Why this is correct
Unlike identity-based policies which do not apply to the root user, SCPs explicitly restrict the root user of a member account. This makes them an extremely powerful tool for enforcing organizational security standards and preventing even administrative users from performing prohibited actions.
- ✗
SCPs are applied to the management account of the organization to restrict its own administrator activities.
Why it's wrong here
SCPs do not apply to the management account of an AWS Organization. They only affect member accounts. This design ensures that the management account always retains full control over the organization and can perform recovery or administrative tasks that might be blocked in member accounts.
- ✓
An explicit Deny in an SCP overrides any Allow in an IAM policy within the member account.
Why this is correct
Following the standard AWS policy evaluation logic, an explicit deny in an SCP is final. If an SCP denies an action, no identity-based or resource-based policy within the member account can override that denial, effectively creating an unbreakable guardrail for that account's resources.
- ✗
SCPs are used to manage resource-level permissions for cross-account access between different organizations.
Why it's wrong here
SCPs only function within the boundaries of a single AWS Organization. They cannot be used to control access or set guardrails for accounts belonging to a different organization. Cross-account access between organizations is managed through IAM roles, resource-based policies, and potentially resource-level conditions.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.