Quizzes · Service

Organizations

Level 0 questions on Organizations. Read about it first if it's new to you.

Works with: IAM (4), Control Tower (4), CloudTrail (4), IAM Identity Center (2), RDS (1), Config (1)

15 questions, from a pool of 23
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?

No. SCPs only set the most an account can do; something must still grant the permission.Correct. An SCP never grants anything. With no identity policy and no bucket policy allowing it, the request is implicitly denied.Yes. The SCP allows s3:* for every role in the OU.Not this one. SCPs are a ceiling, not a grant. An Allow in an SCP only means "IAM may allow this here".Yes, but only for buckets in the same Region as the role.Not this one. Roles are global and Regions have nothing to do with it. Nothing grants the permission, so the answer is no.Only if the role was created through Control Tower.Not this one. How the role was created doesn't matter. Permissions come from policies, not from the tool that made the role.

Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0

Question 2Why does Todo.io keep its apps out of the management account of its organization?

SCPs never apply to the management account, so the organization's guardrails can't protect anything running there.Correct. The management account sits above every SCP. Keeping it empty, apart from billing and account management, means nothing important runs without guardrails.The management account can't create VPCs or databases.Not this one. It can create anything any account can. The problem is that nothing restricts it.Resources in the management account are billed twice.Not this one. Billing is consolidated once, at the organization level. Where a resource runs makes no difference to its price.The management account has no CloudTrail.Not this one. It has CloudTrail like every account. That isn't why it's kept empty.

Learn it: AWS Organizations · SCP (service control policy) · Set up AWS: Day 0

Question 3Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?

An SCP on the Prod OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.Correct. "Can ever" asks for a preventive control. An SCP Deny blocks the API call for everyone in the account, administrators and root included.An AWS Config rule that checks CloudTrail is turned on.Not this one. Config is detective: it tells you after logging was stopped. The requirement says it must never happen.A CloudWatch alarm that emails the security team when logging stops.Not this one. An alarm also fires after the fact. Being told isn't the same as preventing it.Remove cloudtrail:StopLogging from every IAM policy in the account.Not this one. Anyone who can edit IAM policies could add it back. An SCP sits outside the account, where they can't change it.

Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower

Question 4Todo.io runs six AWS accounts and wants a single bill, with usage across all six counted together for volume pricing. What gives them that?

AWS Organizations, with every account in one organization (consolidated billing).Correct. The management account pays for every member account on one bill, and usage is combined across them.Tagging every resource in every account with "todo-io".Not this one. Tags help you split and analyse costs. They don't merge six bills into one.Moving everything into one account.Not this one. That gives one bill, but throws away the isolation that separate accounts give you.Signing in to all six accounts through IAM Identity Center.Not this one. Identity Center handles sign-in. It has nothing to do with billing.

Learn it: AWS Organizations

Question 5Todo.io attaches an SCP to its Workloads OU. The Prod and Dev accounts sit in that OU, and a Sandbox OU sits inside it. Which accounts does the SCP apply to?

Every account in the Workloads OU, including accounts in the Sandbox OU inside it.Correct. A policy on an OU is inherited by every account below it, however deep.Only accounts created after the SCP was attached.Not this one. Existing accounts are covered the moment the SCP is attached.Prod and Dev, but not the accounts in the Sandbox OU.Not this one. Nested OUs inherit their parent's policies.Only the IAM users in those accounts, not the roles.Not this one. SCPs apply to every user and role in a member account, root included.

Learn it: AWS Organizations · SCP

Question 6Todo.io wants to stop anyone, including the root user, from deleting the audit bucket in its Prod account. Prod is a member account. Can an SCP do that?

Yes. SCPs apply to the root user of a member account too.Correct. IAM policies can't limit root, but an SCP can, in member accounts.No. The root user ignores every policy.Not this one. Root ignores IAM policies, not SCPs. In a member account, an SCP Deny stops root too.Only if the root user has MFA turned on.Not this one. MFA protects how root signs in. It doesn't change what an SCP allows.Only if Prod is the management account.Not this one. The opposite: SCPs never apply to the management account.

Learn it: SCP (service control policy) · Root user

Question 7An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?

Service-linked roles, such as the one RDS uses to manage its own network interfaces.Correct. SCPs never apply to service-linked roles, so AWS services can keep running what they manage for you.IAM users in the Prod account.Not this one. SCPs apply to every IAM user in a member account.IAM roles in the Prod account.Not this one. SCPs apply to every IAM role in a member account, except service-linked roles.The root user of the Prod account.Not this one. SCPs apply to root in member accounts.

Learn it: SCP (service control policy) · Service-linked role

Question 8Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?

An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions.Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule.An IAM policy on every user and role that only allows those Regions.Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added.An AWS Config rule that flags resources in other Regions.Not this one. Config reports after the fact. The requirement says it may only run there.Deleting the default VPC in every other Region.Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.

Learn it: SCP (service control policy) · Controls (guardrails) · Region

Question 9Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?

From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account.Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys.Sign in to the new account as root with the management account's password.Not this one. Each account has its own root user and email address. The management account's password doesn't open it.Use the IAM user that Organizations creates for the administrator.Not this one. Organizations creates a role, not an IAM user.Wait for the new account to accept an invitation.Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.

Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role

Question 10Why does Todo.io put Prod and Dev in separate AWS accounts rather than in one account?

An account is the strongest isolation boundary in AWS. Nothing in Dev can touch Prod unless it is explicitly allowed.Correct. A mistake, a leaked key or a runaway script in Dev stays in Dev. Separate accounts also give separate bills and quotas.Separate accounts are cheaper than one.Not this one. Accounts are free, but splitting doesn't lower the price of what runs in them.One account can only hold one VPC.Not this one. An account can have several VPCs in every Region.IAM can't tell Prod and Dev resources apart in one account.Not this one. It can, with careful policies, but it's easy to get wrong. The account boundary is far simpler and stronger.

Learn it: AWS account

Question 11Todo.io wants every production account, including ones it adds next year, to get the same guardrails automatically. What should it do?

Group the production accounts in a Prod OU and attach the guardrails (SCPs) to the OU.Correct. An OU is a folder of accounts. Move a new account into it and it inherits everything attached there.Attach the SCPs to each production account one by one.Not this one. It works today, but next year's accounts are only protected if someone remembers.Put the production accounts in an IAM group.Not this one. IAM groups hold IAM users, not accounts.Tag each production account "prod".Not this one. Tags don't attach policies by themselves.

Learn it: AWS Organizations · SCP

Question 12A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 13Todo.io needs a new account for its data team. It must arrive with logging on, guardrails applied and sign-in through Identity Center already set up. What creates it?

Control Tower's Account Factory.Correct. Account Factory stamps out accounts from a template, already enrolled in the landing zone.Create the account in the Organizations console and configure everything afterwards.Not this one. You would then have to set up logging, guardrails and sign-in by hand, and enroll the account.Copy the Prod account.Not this one. Accounts can't be copied.IAM Identity Center.Not this one. Identity Center gives people access to accounts. It doesn't create them.

Learn it: Account Factory

Question 14A teammate edits one of Control Tower's SCPs by hand in the Organizations console. What does Control Tower do?

It reports drift, so the landing zone can be repaired to match its intended setup.Correct. Control Tower notices changes made outside it. Fixing the drift puts its managed resources back as they should be.Nothing. Changes made in the Organizations console are invisible to it.Not this one. Control Tower watches the resources it manages, wherever they are changed.It deletes the account that was changed.Not this one. It never deletes accounts on its own.It blocks the edit before it happens.Not this one. The edit goes through. Control Tower reports it afterwards.

Learn it: AWS Control Tower

Question 15In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?

The request is denied. An explicit Deny anywhere always wins.Correct. IAM checks every policy that applies. One explicit Deny, here in the SCP, overrides any number of Allows.The request is allowed, because the role's own policy is more specific than the SCP.Not this one. Specificity never matters in IAM. A Deny beats an Allow, wherever each one is written.The request is allowed, because SCPs only apply to the root user.Not this one. SCPs apply to every user and role in a member account, root included.The request is allowed, but AWS Config reports it afterwards.Not this one. Config is detective: it reports after the fact. This request never happens, because the SCP is preventive.

Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region

Question 16Todo.io wants one trail that records every account and every Region in its organization. What should it create?

An organization trail, from the management account.Correct. One trail covers every account and Region, including accounts added later.A trail in each account, one by one.Not this one. That works, but every new account needs one, and each account could switch its own off.An IAM Identity Center permission set.Not this one. Permission sets give people access; they don't record anything.An SCP.Not this one. SCPs limit what can be done; they record nothing.

Learn it: CloudTrail

Question 17An administrator in Todo.io's Dev account tries to turn off the organization trail. What happens?

They can't. Member accounts can see an organization trail but can't change or stop it.Correct. Only the management account (or a delegated administrator) controls the organization trail.It stops for every account in the organization.Not this one. Member accounts can't touch it.It stops, but only for the Dev account.Not this one. Member accounts can't switch it off for themselves either.Only the Dev account's root user can stop it.Not this one. Root in a member account can't change it either.

Learn it: CloudTrail

Question 18What does "AWS Organizations" mean?

Groups many AWS accounts under one management account, with one bill and shared guardrails.Correct. Think of it as: The building management company that owns every flat.A second proof of identity, like a code from an app or a security key, on top of a password.Not this one. That describes MFA (multi-factor authentication).An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.Not this one. That describes Root user.

Learn it: AWS Organizations

Question 19Which term is this? "Groups many AWS accounts under one management account, with one bill and shared guardrails."

AWS OrganizationsCorrect. Yes. Think of it as: The building management company that owns every flat.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.

Learn it: AWS Organizations

Question 20Which AWS term is described by this analogy? "The building management company that owns every flat."

AWS OrganizationsCorrect. Yes: Groups many AWS accounts under one management account, with one bill and shared guardrails.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password. Its analogy: A PIN on top of the key card.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it. Its analogy: The master key to the whole building.

Learn it: AWS Organizations

Question 21What does "SCP (service control policy)" mean?

An organization-wide guardrail that sets the most any identity in an account may do.Correct. Think of it as: The building's rules. Your lease can't give you permission to break them.Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.A second proof of identity, like a code from an app or a security key, on top of a password.Not this one. That describes MFA (multi-factor authentication).

Learn it: SCP (service control policy)

Question 22Which term is this? "An organization-wide guardrail that sets the most any identity in an account may do."

SCP (service control policy)Correct. Yes. Think of it as: The building's rules. Your lease can't give you permission to break them.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password.

Learn it: SCP (service control policy)

Question 23Which AWS term is described by this analogy? "The building's rules. Your lease can't give you permission to break them."

SCP (service control policy)Correct. Yes: An organization-wide guardrail that sets the most any identity in an account may do.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password. Its analogy: A PIN on top of the key card.

Learn it: SCP (service control policy)

Organizations

Worth another look

Your weak spots

Services

Concepts