ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 379 - SAP-C01 discussion

Report
Export

A Solutions Architect is designing a multi-account structure that has 10 existing accounts. The design must meet the following requirements:

Consolidate all accounts into one organization.

Allow full access to the Amazon EC2 service from the master account and the secondary accounts. Minimize the effort required to add additional secondary accounts. Which combination of steps should be included in the solution? (Choose two.)

A.
Create an organization from the master account. Send invitations to the secondary accounts from the master account. Accept the invitations and create an OU.
Answers
A.
Create an organization from the master account. Send invitations to the secondary accounts from the master account. Accept the invitations and create an OU.
B.
Create an organization from the master account. Send a join request to the master account from each secondary account. Accept the requests and create an OU.
Answers
B.
Create an organization from the master account. Send a join request to the master account from each secondary account. Accept the requests and create an OU.
C.
Create a VPC peering connection between the master account and the secondary accounts. Accept the request for the VPC peering connection.
Answers
C.
Create a VPC peering connection between the master account and the secondary accounts. Accept the request for the VPC peering connection.
D.
Create a service control policy (SCP) that enables full EC2 access, and attach the policy to the OU.
Answers
D.
Create a service control policy (SCP) that enables full EC2 access, and attach the policy to the OU.
E.
Create a full EC2 access policy and map the policy to a role in each account. Trust every other account to assume the role.
Answers
E.
Create a full EC2 access policy and map the policy to a role in each account. Trust every other account to assume the role.
Suggested answer: A, D

Explanation:

There is a concept of Permission Boundary vs Actual IAM Policies. That is, we have a concept of “Allow” vs “Grant”. In terms of boundaries, we have the following three boundaries:

1. SCP

2. User/Role boundaries

3. Session boundaries (ex. AssumeRole ... )

In terms of actual permission granting, we have the following:

1. Identity Policies

2. Resource Policies

asked 16/09/2024
umar raad
36 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first