Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 988 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03

Question #: 988
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag.

Which combination of steps will meet these requirements? (Choose two.)

A. In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU.
B. In Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU.
C. Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU.
D. Create a service control policy (SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU.
E. Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found.

Show Suggested Answer

Suggested Answer: AD 🗳️

by viejito at Oct. 7, 2024, 11:43 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

FlyingHawk

1 week, 3 days ago

Selected Answer: AD

As depicted in this aws blog https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/ A - Tag Policy only enforces the accepted value of a tag, and not its presence. (step 1) D - SCP Policies enforce the presence of tag. (step 2 and 3)

upvoted 1 times

...

LeonSauveterre

4 weeks ago

Selected Answer: AD

B - SCPs cannot directly enforce tag values; they can only allow or deny actions based on tags. C - Tag policies in AWS Organizations can't deny actions, such as launching untagged instances or deleting tags. E - AWS Lambda is definitely irrelevent.

upvoted 2 times

...

Rayan999

3 months, 2 weeks ago

Selected Answer: AD

Ofcourse A and D. B is little bit close to the answer but its not

upvoted 3 times

...

jingen11

3 months, 2 weeks ago

Selected Answer: AD

A: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html D: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html

upvoted 4 times

...

viejito

4 months ago

Respuesta A D .

upvoted 3 times

...

Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 988 discussion

Comments

FlyingHawk

LeonSauveterre

Rayan999

jingen11

viejito

SY0-701