Develop a strategy to centrally deploy and manage AWS accounts.
9 practice questions under this official exam objective (SCS-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
9 total · page 1 of 1Auto-enroll all org accounts in Security Hub via a delegated admin and a configuration pol
All new Control Tower-provisioned accounts must become Security Hub members with the least development effort. Designating a Security Hub delegated ad
Use IAM Identity Center with the external IdP and permission sets for scalable multi-accou
With over 100 growing accounts and an external corporate IdP, the company needs scalable role-based access. AWS IAM Identity Center integrates with th
Use IAM Identity Center with the external IdP and permission sets for org-wide access
The company is creating an AWS Organization and needs to federate its external IdP for user management while centrally controlling access to all AWS a
Auto-enable Security Hub for all accounts and aggregate findings across Regions
Security Hub must centrally monitor a dedicated account, automatically cover existing and new organization accounts, and receive findings from all Reg
Attach an SCP that denies service access to the member-account root user
To protect member accounts even if root credentials are compromised, attach an SCP to the OU that uses an explicit deny on the root user's actions (e.
Use AWS Service Catalog with CloudFormation and enforce tagging with AWS Config rules
To deploy approved architectural patterns via CloudFormation across org accounts while enforcing tagging and configuration guidelines, use AWS Service
Share CloudFormation StackSets from an admin account and use SCPs to block non-compliant p
Three deployment mandates: EC2 only from approved accounts, DynamoDB with standardized naming, and all infrastructure via CloudFormation. Use AWS Clou
Edit the root SCP to add a Condition excluding the marketing account from the external-sha
An SCP at the organization root denies sharing resources with external accounts for all members of one OU, and only the marketing account needs an exc
Set up an Inspector delegated administrator and enable automatic scanning for new member a
For organization-wide host-based vulnerability and network-exposure scanning of EC2 and ECR, with findings to Security Hub and automatic coverage of n