Topic 1 Question 287
A large company recently acquired a small company. The large company invited the small company to join the large company's existing organization in AWS Organizations as a new OU.
A DevOps engineer determines that the small company needs to launch t3.small Amazon EC2 instance types for the company's application workloads. The small company needs to deploy the instances only within US-based AWS Regions.
The DevOps engineer needs to use an SCP in the small company's new OU to ensure that the small company can launch only the required instance types.
Which solution will meet these requirements?
Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*.
Configure a statement to deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
Configure a statement to allow the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is equal to t3.small. Configure another statement to allow the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is equal to us-*.
ユーザの投票
コメント(2)
- 正解だと思う選択肢: A
A
deny the ec2:RunInstances action for all EC2 instance resources when the ec2:InstanceType condition is not equal to t3.small
deny the ec2:RunInstances action for all EC2 instance resources when the aws:RequestedRegion condition is not equal to us-*
👍 3CHRIS127222222024/12/25 - 正解だと思う選択肢: A
Very important: • An Allow statement in an SCP permits the Resource element to only have a "*" entry. • An Allow statement in an SCP can't have a Condition element at all. Because of the second point, B and D are not right because these are adding conditions in the allow statement. C does not mean and deny the requirements so A is the right answer.
👍 2c87b4332025/02/04
シャッフルモード