A company has an AWS Control Tower landing zone.

Amazon Web Services DOP-C02 Question Answer

A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications.

The DevOps team needs to allow only a specific management 1AM role to manage the 1AM roles and policies of any AWS accounts In only the production OU.

Which combination of steps will meet these requirements? {Select TWO.)

Create an SCP that denies full access with a condition to exclude the management 1AM role for the organization root.

Ensure that the FullAWSAccess SCP is applied at the organization root

Create an SCP that allows IAM related actions Attach the SCP to the development OU

Create an SCP that denies IAM related actions with a condition to exclude the management I AM role Attach the SCP to the workload OU

Create an SCP that denies IAM related actions with a condition to exclude the management 1AM role Attach the SCP to the production OU

Amazon Web Services DOP-C02 View All Questions

Amazon Web Services DOP-C02 Summary

Vendor: Amazon Web Services
Product: DOP-C02
Update on: Nov 11, 2025
Questions: 366

Price: $52.5 ~~$149.99~~

Buy Now DOP-C02 PDF + Testing Engine Pack

A company is developing a mobile app that requires extensive automated testing across multiple device...

A company has migrated its container-based applications to Amazon EKS and want to establish automated...

11.11 Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmasmnth

A company has an AWS Control Tower landing zone.

The Answer Is:

Explanation:

Amazon Web Services DOP-C02 Summary

Payments We Accept

Contact Us