Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
IAM permissions do not override SCPs. Even if developers have IAM policies allowing s3:CreateBucket, an SCP restriction will still block it unless explicitly allowed.
Your statement is correct but the policy does not deny action on S3. So the SCP is not causing any problems. So it is C.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" }, { "Sid": "DenyCloudTrail", "Effect": "Deny", "Action": "cloudtrail:*", "Resource": "*" }, { "Sid": "AllowS3CreateBucket", "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "*" } ] }