What is the recommended way to enforce MFA on the root user of member accounts in an organization?

Use a service control policy (SCP) to require MFA for all IAM users.

Create an IAM role that requires MFA and assign it to the root user.

Use AWS IAM Identity Center to enforce MFA on root users.

Enable MFA on each root user using a hardware device or virtual MFA.

What is the landing zone in AWS Control Tower?

A single AWS account with pre-configured security groups.

A multi-account environment that is set up and governed by AWS Control Tower.

A virtual private cloud (VPC) that spans multiple regions.

A backup of the management account's data.

What is the purpose of an AI service opt-out policy in AWS Organizations?

To block all access to AWS AI services.

To manage the cost of AI services.

To enforce encryption on AI service data.

To control whether AWS AI services can store and use content for service improvement.

What is the purpose of resource control policies (RCPs) in AWS Organizations?

To enforce tagging standards on resources.

To grant additional permissions to IAM roles.

To manage the lifecycle of AWS resources.

To control the maximum permissions available to resources in your organization.

What is the primary purpose of consolidated billing in AWS Organizations?

To automatically create new member accounts when needed.

To provide a single sign-on for all member accounts.

To enforce security policies across all member accounts.

To combine usage from all accounts into a single bill and potentially lower costs through volume discounts.

AWSCertified Security - Specialty

Domain 6Objective 1

Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 4)

Part of the Content Domain 6: Security Foundations and Governance domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

13concepts

14%of the exam

13 Concepts in This Objective

AWS Organizations fundamentals
Creating and managing an organization
AWS Control Tower setup
Control Tower controls
Service control policies (SCPs)
Resource control policies (RCPs)
AI service opt-out policies
Declarative policies
Delegated administrator accounts
Centralized security service management
Root user credential management
Root user MFA enforcement
Break-glass procedures

Questions 16–20

16foundation · easy
What is the recommended way to enforce MFA on the root user of member accounts in an organization?
Select an answer first
17foundation · easy
What is the landing zone in AWS Control Tower?
Select an answer first
18foundation · easy
What is the purpose of an AI service opt-out policy in AWS Organizations?
Select an answer first
19foundation · easy
What is the purpose of resource control policies (RCPs) in AWS Organizations?
Select an answer first
20foundation · easy
What is the primary purpose of consolidated billing in AWS Organizations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.