SAA-C03 Question 151

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose CE1

  C. Use AWS Organizations to configure service control policies (SCPs) that prevent VPCs from gaining internet access. Deny access to all AWS Regions except ap-northeast-3. Why it's correct: Service control policies (SCPs) are the best way to enforce organization-wide restrictions. You can prevent internet access (e.g., restrict ec2:AttachInternetGateway) and explicitly deny access to AWS services or Regions other than ap-northeast-3. E. Use AWS Config to activate managed rules to detect and alert for internet gateways and to detect and alert for new resources deployed outside of ap-northeast-3. Why it's correct: AWS Config lets you monitor compliance. You can use managed rules like: vpc-internet-gateway-attached to detect unwanted internet connectivity. cloudtrail-enabled, ec2-instance-region-check, etc., to detect deployments outside ap-northeast-3.

• Chose CE2

  ❌ A. Control Tower does not directly prevent internet access; it only provides guardrails, but those can be bypassed in some cases. ✅ C. SCPs (Service Control Policies) in AWS Organizations provide hard restrictions at the account level, making them more enforceable than Control Tower guardrails alone. ✅E. AWS Config ensures continuous monitoring and alerts, which Control Tower does not provide as effectively. This ensures strong security controls, compliance enforcement, and real-time monitoring while maintaining AWS best practices.

• Chose CE1

  Option C provides centralized governance with SCPs, and Option E provides continuous monitoring and alerting for compliance. Together, these solutions meet the requirements of restricting internet access and ensuring usage of only the ap-northeast-3 region.