SAP-C02 Question 371

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose BDE1

  B - Access Advisor helps determine which AWS services are actively used D - AWS Organizations attaches a default "FullAWSAccess" SCP to all member accounts, allowing full access unless explicitly restricted.To enforce service restrictions, this SCP must be removed or replaced with a custom SCP. E - Organizational Units (OUs) help manage multiple accounts together

• Chose ABE2

  Isn't this called IAM Access Analyzer instead of Advisor?

• 1

  With a deny list strategy a default SCP allows all services and deny lists must be implemented for any specific services that must be restricted.