Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is using AWS Organizations and wants to restrict the maximum permissions that can be granted to Amazon S3 buckets and objects across all accounts. The security team wants to ensure that even if an IAM policy grants s3:GetObject, the resource itself cannot be made public. Which policy type should they use?

   • AIAM policy attached to all users and roles that denies s3:PutBucketPolicy.
   • BService control policy (SCP) that denies the s3:PutBucketPolicy action.
   • CAWS Config rule that checks for public S3 buckets and automatically remediates them.
   • DResource control policy (RCP) that denies the s3:PutBucketPolicy action when the policy would grant public access.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is restructuring its AWS Organization. They have a member account that was previously in the 'Development' OU and needs to be moved to the 'Production' OU. The security team wants to ensure that the move does not inadvertently grant the account more permissions than it had before. What should the security team do?

   • ADetach all SCPs from the account before moving it to the 'Production' OU.
   • BReview the SCPs attached to the 'Production' OU before moving the account to ensure they are at least as restrictive as the 'Development' OU SCPs.
   • CMove the account and then immediately review the effective permissions using the IAM Policy Simulator.
   • DCreate a new OU specifically for this account with the same SCPs as the 'Development' OU.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has a strict security policy that requires root user MFA for all accounts. They have a member account where the root user's hardware MFA device has been lost and the password is unknown. The security team needs to regain access to the root user to perform a critical configuration change. The team has already tried to use the 'Forgot password' flow but cannot proceed because MFA is required. What is the most appropriate break-glass procedure?

   • AUse the root user credentials stored in the company's password manager to log in and change the MFA device.
   • BDelete the member account and recreate it with new root user credentials.
   • CContact AWS Support and complete the identity verification process to have the MFA device removed and password reset.
   • DUse the management account to assume an IAM role in the member account and reset the root user password.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which action is required to add an existing AWS account to your organization?

   • ACreate a new account from the AWS Organizations console.
   • BSend an invitation to the account's root user email address.
   • CUse AWS CloudFormation to import the account.
   • DContact AWS Support to merge the accounts.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which AWS service configuration can be enforced using a declarative policy?

   • AIAM user password length
   • BVPC CIDR block
   • CEC2 instance type
   • DAmazon S3 bucket encryption
   Reveal Solution Discussion Select an answer first