SOA-C02 Security and Compliance Practice Question
A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.
A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level. Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new IAM policy that denies access from the IP address and attach it to all users.
Why it's wrong here
This is incorrect. An IAM policy attached to all users would only affect users in the current account, not all accounts in the organization. Additionally, managing policies for all users individually is not scalable and does not block API calls from roles or other principals.
- ✗
Create an IAM policy that denies access from the IP address and attach it to the organization root.
Why it's wrong here
IAM policies are identity-based or resource-based and can only be attached to IAM users, groups, roles, or specific AWS resources—never to the organization root, an organizational unit, or an AWS account as a whole. The organization root is a container for accounts and OUs, and the only policy type that can be attached at that level is a service control policy (SCP), which manages permissions across all accounts in the organization. Attaching an IAM policy to the organization root is not a valid operation in AWS, so this approach would not deny access from the IP address.
- ✓
Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.
Why this is correct
This is correct. A service control policy (SCP) attached to the root organizational unit applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and role sessions across all accounts.
- ✗
Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.
Why it's wrong here
This is incorrect. Service control policies cannot be attached directly to IAM users; they are applied at the organization root, OU, or account level. Also, SCPs affect all principals in the target accounts, not a single user.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.