SOA-C02 Security and Compliance Practice Question

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

⚠ Common exam trap

It's easy for candidates to confuse IAM password policies or CloudTrail monitoring with preventive controls, but only SCPs provide a centralized, enforceable denial across all accounts in an AWS Organization.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.

Service control policies (SCPs) are the most effective way to enforce a guardrail across all accounts in an AWS Organization because they allow you to centrally deny or restrict permissions at the root, OU, or account level, overriding any IAM policies attached to users or roles. By applying an SCP that denies iam:CreateAccessKey, the security team ensures that no IAM user in any account within the organization can create access keys, regardless of their individual IAM policies. This approach is scalable and cannot be bypassed by account administrators, making it the correct choice for organization-wide enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Attach an IAM policy to the root user that denies iam:CreateAccessKey.
Why it's wrong here
Attaching an IAM policy to the root user is ineffective because the root user is the account owner, not an IAM user, and IAM policies cannot be attached to the root user entity. Even if a policy could be attached, root user permissions are managed separately and are not subject to standard IAM policies. In a multi-account organization, the requirement is to enforce a restriction across every account, which this approach cannot do.
✗
Configure an IAM password policy that requires strong passwords.
Why it's wrong here
An IAM password policy governs password strength and rotation for IAM users when they sign in to the AWS Management Console; it has no bearing on programmatic access credentials. Access keys are generated based on IAM permissions, not password complexity. Therefore, configuring a strong password policy does nothing to prevent users from creating access keys.
✓
Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.
Why this is correct
A service control policy (SCP) is the correct mechanism because it centrally governs the maximum available permissions for all IAM users, roles, and even the root user within every member account of an AWS Organization. An SCP that denies iam:CreateAccessKey ensures that no principal in any account can create new access keys, regardless of their IAM policies, making it a preventive, organization-wide control.
✗
Use AWS CloudTrail to monitor and alert on CreateAccessKey events.
Why it's wrong here
AWS CloudTrail provides a record of API activity, including CreateAccessKey events, and can trigger CloudWatch alarms for auditing or alerting purposes, but it is purely detective. It does not intercept or deny the API call, so it cannot prevent a user from creating access keys. The requirement is to proactively prohibit the action, which requires a preventive control such as an SCP.

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question