Discuss Amazon DOP-C02 Exam Topic 5 Question 46

A company uses AWS Organizations to manage its AWS accounts. The organization root has a child OU that is named Department. The Department OU has a child OU that is named Engineering. The default FullAWSAccess policy is attached to the root, the Department OU. and the Engineering OU.

The company has many AWS accounts in the Engineering OU. Each account has an administrative 1AM role with the AdmmistratorAccess 1AM policy attached. The default FullAWSAccessPolicy is also attached to each account.

A DevOps engineer plans to remove the FullAWSAccess policy from the Department OU The DevOps engineer will replace the policy with a policy that contains an Allow statement for all Amazon EC2 API operations.

What will happen to the permissions of the administrative 1AM roles as a result of this change'?

AAll API actions on all resources will be allowed

BAll API actions on EC2 resources will be allowed. All other API actions will be denied.

CAll API actions on all resources will be denied

DAll API actions on EC2 resources will be denied. All other API actions will be allowed.

Suggested Answer: B

* Impact of Removing FullAWSAccess and Adding Policy for EC2 Actions:

The FullAWSAccess policy allows all actions on all resources by default. Removing this policy from the Department OU will limit the permissions that accounts within this OU inherit from the parent OU.

Adding a policy that allows only Amazon EC2 API operations will restrict the permissions to EC2 actions only.

* Permissions of Administrative IAM Roles:

The administrative IAM roles in the Engineering OU have the AdministratorAccess policy attached, which grants full access to all AWS services and resources.

Since SCPs are restrictions that apply at the organizational level, removing FullAWSAccess and replacing it with a policy allowing only EC2 actions means that for all accounts in the Engineering OU:

They will have full access to EC2 actions due to the new SCP.

They will be restricted in other actions that are not covered by the SCP, hence, non-EC2 API actions will be denied.

* Conclusion:

All API actions on EC2 resources will be allowed.

All other API actions will be denied due to the absence of a broader allow policy.

Get Premium DOP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

31 comments · newest first

Elouise 9 months ago

I’m leaning towards option B, but I’m a bit confused about how the AdministratorAccess policy plays into this. It seems like it should still allow everything.

Lizette 10 months ago

If they replace it with an EC2-only policy, wouldn't that mean only EC2 actions are allowed? I feel like the other actions would be denied.

Gracie 10 months ago

I remember a practice question where changing a policy affected permissions, but I can't recall if it was similar to this scenario.

Tomoko 10 months ago

I'm surprised they would change it like that!

Linn 10 months ago

Definitely not C, that doesn't make sense.

Sarah 10 months ago

I think B is the right answer!

Shelba 11 months ago

Wait, so all other actions get denied? That seems harsh.

Cordelia 11 months ago

The FullAWSAccess policy removal will limit permissions.

Jacquelyne 11 months ago

I think if the FullAWSAccess policy is removed, the roles might lose some permissions, but I'm not sure how it interacts with the AdministratorAccess policy.

Marilynn 11 months ago

Wait, I'm a bit confused. If the default FullAWSAccess policy is attached to the accounts, wouldn't that override the more restrictive policy at the OU level?

Cecil 11 months ago

I'm pretty confident I know the answer here. Removing the FullAWSAccess policy and replacing it with a policy that only allows EC2 actions should limit the permissions of the administrative IAM roles to just EC2.

Tanesha 12 months ago

Okay, let's think this through step-by-step. The key is understanding how the policies are applied at the different levels of the organization.

Lai 12 months ago

This question seems straightforward, but I want to make sure I understand the details correctly before answering.

Elise 1 year ago

I've got a good feeling about this one. The policy change at the Department OU level should impact the permissions of the administrative IAM roles in the Engineering OU accounts.

Alona 1 year ago

I'm a bit confused about how the different policies interact. I'll need to review the AWS Organizations documentation to make sure I have the right understanding before answering.

James 1 year ago

Okay, let's think this through step-by-step. The key is understanding how the policies are applied at the different levels of the organization.

Cornell 1 year ago

This question seems straightforward, but I want to make sure I understand the implications of the policy change. I'll need to carefully consider how the permissions will be affected.

Reynalda 2 years ago

I agree with Lera, option B seems like the correct answer based on the scenario described.

Aliza 2 years ago

That makes sense, since the new policy will only contain an Allow statement for EC2 API operations.

Lera 2 years ago

I believe that only API actions on EC2 resources will be allowed.

Aliza 2 years ago

I think the permissions of the administrative 1AM roles will change.

Ulysses 2 years ago

This is a tricky one, but I think option B is the safest bet. Gotta love these AWS Organization questions, they always keep you on your toes!

Jamika 2 years ago

Haha, I bet the DevOps engineer who came up with this change is feeling pretty confident in their AWS knowledge. Option B seems like the way to go though.

Lindsey 1 year ago

↳ replying to Jamika

The administrative 1AM roles will only have permissions for EC2 resources after this change.

Curtis 1 year ago

↳ replying to Jamika

Yeah, removing the FullAWSAccess policy and allowing only EC2 API operations makes sense.

Norah 1 year ago

↳ replying to Jamika

I agree, option B seems like the most logical choice.

Ciara 2 years ago

I'm not so sure, I'm leaning towards option D. If the new policy only allows EC2 actions, then all other API actions will be denied for the administrative roles.

Lamar 2 years ago

Hmm, I think option B is the correct answer here. The new policy will only allow EC2 API operations, so the administrative IAM roles will only have access to those specific actions.

Effie 1 year ago

↳ replying to Lamar

Yes, it's important to carefully manage permissions to ensure security and compliance.

Anglea 2 years ago

↳ replying to Lamar

That makes sense. The administrative IAM roles will have limited permissions after the change.

Ronnie 2 years ago

↳ replying to Lamar

I agree, option B seems to be the correct choice. The new policy will restrict access to only EC2 API operations.

Amazon DOP-C02 Exam - Topic 5 Question 46 Discussion