Your AWS Organization has below hierarchy.

Answer options:

A.The action will be denied as the SCP in Admin_OU denies the operation.
B.The action will be allowed as the SCP in the root has full AWS access, and Bob is attached with full S3 permissions.
C.The action will be denied as SCP in DEV1_OU has an S3 Deny policy, which takes priority.
D.The action will be allowed as DEV2_OU is attached with an S3 Allow SCP policy, which takes priority.

Correct Answer – A
About how SCPs work, please refer to the documentation in
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html.
One rule is that any action that has an explicit Deny always takes priority.
Option A is CORRECT because DEV2_OU inherits the SCP in Admin_OU which contains a Deny policy. The policy overrides any Allow that other SCPs might grant.
Option B is incorrect: because other SCPs that the OU has inherited should also be considered.
Option C is incorrect because the SCP in DEV1_OU does not need to be considered as it is not a parent node for user Bob.
Option D is incorrect: because the Allow policy does not override a Deny policy if it exists.