You are in charge of configuring an AWS Organization as below hierarchy.

Answer options:

A.Create an SCP that denies required actions and attach it to Root. Attach another SCP that contains an Allow list in Project_OU.
B.In Project_OU, attach an SCP that contains a Deny list to deny the deletion of IAM roles.
C.Make sure that Root, Project_OU, and Security_OU are attached with a full access SCP. Attach another SCP that contains the Deny list to DEV1_OU, DEV2_OU, and QA1_OU.
D.Create an SCP that denies the required actions. Attach it to Project_OU, DEV_OU, and QA_OU.

Correct Answer – B
OUs in AWS Organization inherit the SCPs from the parent OU. Reference can be found in
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html.
Option A is incorrect because it is improper to attach the Deny SCP to Root as it affects all other nodes including Security_OU.
Option B is CORRECT: because the Deny SCP only affects all OUs under Project_OU. Other OUs such as Security_OU are not affected.
Option C is incorrect because Project_OU and Security_OU do not need to attach full access SCP since they can inherit from the Root.
Option D is incorrect: because DEV_OU and QA_OU are not required to attach the Deny SCP separately since Project_OU as a parent can effectively do that.