Practice · AWS Certified Solutions Architect

~/aws-sap-c02 · aws-sap-c02_d1_19466a8ae594 ▊

← AWS Certified Solutions Architect - Professional · practice sheet

aws-sap-c02_d1_19466a8ae594 domain/d1 · medium single

A company's security team attaches an SCP to an OU that denies access to a set of AWS services. An account administrator in that OU then attaches the AdministratorAccess IAM policy to a role. A developer using that role reports they still cannot call one of the denied services. What is the correct explanation?

A The AdministratorAccess policy overrides the SCP, so the issue must be an unrelated service outage
B SCPs set a permission guardrail, so a permission blocked by the SCP cannot be used even if AdministratorAccess is attached
C The developer must also be granted a resource-based policy before the SCP allows the action
D SCPs only apply to the root user, so the role should have unrestricted access

Unlock this exam to join the per-question discussion and vote on questions.

next question →