A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and AWS STS in specific accounts. What is a scalable and ef...


Amazon SCS-C01 Exam

Questions Number: 23 out of 160 Questions
14.37%

Question 23
A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and AWS STS in specific accounts.
What is a scalable and efficient approach to meet this requirement?
A. Set up an AWS Organizations hierarchy, and replace the FullAWSAccess policy with the following Service Control Policy for the governed organization units:
Image SCS-C01_23QA.png related to the Amazon SCS-C01 Exam
B. Create multiple IAM users for the regulated accounts, and attach the following policy statement to restrict services as required:
Image SCS-C01_23QB.png related to the Amazon SCS-C01 Exam
C. Set up an Organizations hierarchy, replace the global FullAWSAccess with the following Service Control Policy at the top level:
Image SCS-C01_23QC.png related to the Amazon SCS-C01 Exam
D. Set up all users in the Active Directory for federated access to all accounts in the company. Associate Active Directory groups with IAM groups, and attach the following policy statement to restrict services as required:
Image SCS-C01_23QD.png related to the Amazon SCS-C01 Exam




Previous Questions Next Questions