SCS-C02 Management and Security Governance Practice Question
A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service control policy (SCP) in AWS Organizations
AWS CloudTrail logs API calls but does not enforce policies. Option B is incorrect because AWS Config rules can detect noncompliant roles after creation but cannot prevent their creation. Option C is correct because Service Control Policies (SCPs) in AWS Organizations can deny the creation of IAM roles that do not have a specific managed policy attached, using a condition like `aws:RequestedManagedPolicy`. Option D is incorrect because IAM permissions boundaries limit the maximum permissions a role can have but do not enforce attachment of a specific managed policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail logs, does not enforce.
- ✗
AWS Config rules
Why it's wrong here
Config is detective, not preventive.
- ✓
Service control policy (SCP) in AWS Organizations
Why this is correct
SCPs can deny role creation if required policy is not attached.
- ✗
IAM permissions boundary
Why it's wrong here
Permissions boundary limits permissions but does not enforce policy attachment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.