What is the purpose of moving an account to a different organizational unit (OU) within AWS Organizations?

To enable consolidated billing for that account.

To apply a different set of service control policies (SCPs) to that account.

To change the account's root user email address.

To change the account's billing method.

A company is required by its data privacy policy to prevent AWS AI services from using its content for service improvement. The company has multiple accounts in AWS Organizations. The security team needs to enforce this setting across all accounts. What should they do?

Use AWS Control Tower to enable a mandatory control that enforces AI service opt-out.

Create an SCP that denies the use of all AI services.

Create an AI service opt-out policy and attach it to the root OU in AWS Organizations.

Enable the opt-out setting manually in each account's AI service console.

A company has a multi-account AWS environment with over 100 accounts. The security team wants to centrally monitor and manage security findings across all accounts. They want to use AWS Security Hub and Amazon GuardDuty. The team wants to avoid having to manually enable these services in each account and wants a single place to view all findings. Which solution should they implement?

Designate a delegated administrator account for Security Hub and GuardDuty, and enable the services from that account to automatically cover all member accounts.

Create an AWS CloudFormation StackSet to deploy Security Hub and GuardDuty to all accounts, and then manually aggregate findings in a central S3 bucket.

Enable Security Hub and GuardDuty in the management account only, and use IAM roles to access findings from member accounts.

Use AWS Config aggregators to collect configuration data from all accounts, and then use Amazon Athena to query for security findings.

A company is using AWS Control Tower and has a custom control that they need to apply to a specific OU. The control is not one of the pre-defined controls. The security team wants to implement this control using an SCP. What is the correct way to do this in Control Tower?

Use AWS CloudFormation to deploy the SCP to the OU and then enable it in Control Tower.

Attach the SCP to the OU in AWS Organizations, and Control Tower will automatically detect and manage it.

Create the SCP directly in the Control Tower console and attach it to the OU.

Create the SCP in AWS Organizations and attach it to the OU, then register it as a custom control in Control Tower.

What is the purpose of declarative policies in AWS Organizations?

To control the cost of AWS services.

To manage the lifecycle of AWS accounts.

To enforce configuration rules for AWS services across the organization.

To grant permissions to IAM users and roles.

AWSCertified Security - Specialty

Domain 6Objective 1

Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 6: Security Foundations and Governance domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

13concepts

14%of the exam

13 Concepts in This Objective

AWS Organizations fundamentals
Creating and managing an organization
AWS Control Tower setup
Control Tower controls
Service control policies (SCPs)
Resource control policies (RCPs)
AI service opt-out policies
Declarative policies
Delegated administrator accounts
Centralized security service management
Root user credential management
Root user MFA enforcement
Break-glass procedures

Questions 1–5

1foundation · easy
What is the purpose of moving an account to a different organizational unit (OU) within AWS Organizations?
Select an answer first
2application · medium
A company is required by its data privacy policy to prevent AWS AI services from using its content for service improvement. The company has multiple accounts in AWS Organizations. The security team needs to enforce this setting across all accounts. What should they do?
Select an answer first
3application · medium
A company has a multi-account AWS environment with over 100 accounts. The security team wants to centrally monitor and manage security findings across all accounts. They want to use AWS Security Hub and Amazon GuardDuty. The team wants to avoid having to manually enable these services in each account and wants a single place to view all findings. Which solution should they implement?
Select an answer first
4application · medium
A company is using AWS Control Tower and has a custom control that they need to apply to a specific OU. The control is not one of the pre-defined controls. The security team wants to implement this control using an SCP. What is the correct way to do this in Control Tower?
Select an answer first
5foundation · easy
What is the purpose of declarative policies in AWS Organizations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.