SCS-C03 Identity and Access Management Practice Question
An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply SCPs at the root level to restrict specific AWS services in member accounts.
Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply SCPs at the root level to restrict specific AWS services in member accounts.
Why this is correct
SCPs applied at the root or organizational unit level are effective at enforcing global compliance standards. They restrict the maximum permissions available to any user or role within the account, ensuring that sensitive services or regions are off-limits, which is fundamental for maintaining a secure and compliant AWS multi-account environment.
- ✗
Assign IAM policies directly to the root user of every member account.
Why it's wrong here
Modifying the root user in member accounts is an anti-pattern. The root user should have multi-factor authentication enabled and be locked away. Assigning policies to it does not scale and is unnecessary, as SCPs already provide the required governance across all identities in the account, including the root user.
- ✓
Use IAM Permission Boundaries on all developer-created roles.
Why this is correct
Permission Boundaries are essential for delegating administrative tasks securely. By setting a boundary on a role, you ensure that even if a developer adds excessive permissions to that role, the effective permissions are capped by the boundary. This allows for safe delegation while maintaining strict control over maximum possible access levels.
- ✗
Configure individual IAM users in every account to ensure fine-grained control.
Why it's wrong here
Managing individual IAM users in every account is a high-maintenance and insecure approach. It is better to use AWS IAM Identity Center to centrally manage identities across all accounts. Manual user creation increases the surface area for credential leaks and makes consistent security posture enforcement nearly impossible at scale.
- ✗
Enable AWS CloudTrail only in the primary management account.
Why it's wrong here
CloudTrail must be enabled in all accounts to maintain a comprehensive audit log. Logging only in the management account provides zero visibility into actions taken within member accounts. Centralized logging is a non-negotiable security requirement for compliance, detection of unauthorized activity, and incident response within an enterprise-level AWS environment.
About these practice questions
One of 99 original SCS-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.