AWS Cloud Practitioner AWS
Organizations & SCPs Practice Test
2026–2027 | Multi-Account
Management, Policies & Detailed
Answers
1. What is the primary purpose of AWS Organizations?
A. To provide centralized management of multiple AWS accounts
B. To replace IAM within individual accounts
C. To provide object storage across accounts
D. To automatically deploy applications to EC2
Answer: To provide centralized management of multiple AWS accounts
Rationale: AWS Organizations enables centralized management of multiple
AWS accounts, including account grouping, consolidated billing, governance,
and policy management.
2. What is the organizational hierarchy used by AWS Organizations?
,A. Region → Availability Zone → Account
B. Organization → Organizational Unit → Account
C. VPC → Subnet → Account
D. IAM → Group → Organization
Answer: Organization → Organizational Unit → Account
Rationale: An AWS Organization can contain organizational units (OUs), and
accounts can belong to the organization or be placed within OUs.
3. What is an Organizational Unit (OU) in AWS Organizations?
A. A physical AWS data center
B. A logical grouping of AWS accounts
C. An IAM permission set
D. A VPC subnet
Answer: A logical grouping of AWS accounts
Rationale: OUs allow accounts to be grouped logically so governance policies
such as SCPs can be applied consistently.
4. Which AWS Organizations feature is primarily responsible for consolidated
billing?
A. AWS IAM
B. AWS Control Tower
C. Consolidated billing
D. AWS CloudFormation
Answer: Consolidated billing
Rationale: Consolidated billing combines charges from member accounts into a
centralized billing structure managed through the organization's management
account.
5. What is the management account in AWS Organizations?
,A. An account used only for EC2 administration
B. The account that creates and centrally manages the organization
C. An account that cannot have IAM users
D. A member account used for application workloads
Answer: The account that creates and centrally manages the organization
Rationale: The management account has special administrative capabilities
within AWS Organizations and is responsible for organization-level
management.
6. Which statement about AWS Organizations accounts is correct?
A. Every account must belong to multiple OUs
B. An account can belong to only one OU at a time
C. Accounts cannot be moved between OUs
D. OUs can contain only IAM users
Answer: An account can belong to only one OU at a time
Rationale: An AWS account can be directly attached to one OU, while OUs
themselves can be nested within other OUs.
7. What does SCP stand for?
A. Service Control Policy
B. Security Configuration Permission
C. Service Configuration Protocol
D. Secure Control Permission
Answer: Service Control Policy
Rationale: Service Control Policies are organization-level policies that establish
permission guardrails for AWS accounts.
8. What is the primary purpose of an SCP?
, A. To grant permissions directly to IAM users
B. To define the maximum available permissions for accounts
C. To encrypt AWS resources
D. To create IAM roles
Answer: To define the maximum available permissions for accounts
Rationale: SCPs establish the maximum permissions that IAM identities in
affected accounts can use. They do not directly grant permissions.
9. Does an SCP grant permissions to an IAM user?
A. Yes, always
B. Yes, but only in the management account
C. No
D. Only when MFA is enabled
Answer: No
Rationale: SCPs do not grant permissions. An identity still requires an applicable
IAM identity-based or resource-based permission, subject to the SCP boundary.
10.If an IAM policy allows an action but an applicable SCP explicitly denies it,
what happens?
A. The IAM policy overrides the SCP
B. The SCP denial takes precedence
C. The action is allowed automatically
D. AWS ignores both policies
Answer: The SCP denial takes precedence
Rationale: An explicit deny in an SCP prevents the affected account's identities
from performing the denied action, even when IAM policies allow it.
11.Which account is not restricted by SCPs in the same way as member
accounts?
Organizations & SCPs Practice Test
2026–2027 | Multi-Account
Management, Policies & Detailed
Answers
1. What is the primary purpose of AWS Organizations?
A. To provide centralized management of multiple AWS accounts
B. To replace IAM within individual accounts
C. To provide object storage across accounts
D. To automatically deploy applications to EC2
Answer: To provide centralized management of multiple AWS accounts
Rationale: AWS Organizations enables centralized management of multiple
AWS accounts, including account grouping, consolidated billing, governance,
and policy management.
2. What is the organizational hierarchy used by AWS Organizations?
,A. Region → Availability Zone → Account
B. Organization → Organizational Unit → Account
C. VPC → Subnet → Account
D. IAM → Group → Organization
Answer: Organization → Organizational Unit → Account
Rationale: An AWS Organization can contain organizational units (OUs), and
accounts can belong to the organization or be placed within OUs.
3. What is an Organizational Unit (OU) in AWS Organizations?
A. A physical AWS data center
B. A logical grouping of AWS accounts
C. An IAM permission set
D. A VPC subnet
Answer: A logical grouping of AWS accounts
Rationale: OUs allow accounts to be grouped logically so governance policies
such as SCPs can be applied consistently.
4. Which AWS Organizations feature is primarily responsible for consolidated
billing?
A. AWS IAM
B. AWS Control Tower
C. Consolidated billing
D. AWS CloudFormation
Answer: Consolidated billing
Rationale: Consolidated billing combines charges from member accounts into a
centralized billing structure managed through the organization's management
account.
5. What is the management account in AWS Organizations?
,A. An account used only for EC2 administration
B. The account that creates and centrally manages the organization
C. An account that cannot have IAM users
D. A member account used for application workloads
Answer: The account that creates and centrally manages the organization
Rationale: The management account has special administrative capabilities
within AWS Organizations and is responsible for organization-level
management.
6. Which statement about AWS Organizations accounts is correct?
A. Every account must belong to multiple OUs
B. An account can belong to only one OU at a time
C. Accounts cannot be moved between OUs
D. OUs can contain only IAM users
Answer: An account can belong to only one OU at a time
Rationale: An AWS account can be directly attached to one OU, while OUs
themselves can be nested within other OUs.
7. What does SCP stand for?
A. Service Control Policy
B. Security Configuration Permission
C. Service Configuration Protocol
D. Secure Control Permission
Answer: Service Control Policy
Rationale: Service Control Policies are organization-level policies that establish
permission guardrails for AWS accounts.
8. What is the primary purpose of an SCP?
, A. To grant permissions directly to IAM users
B. To define the maximum available permissions for accounts
C. To encrypt AWS resources
D. To create IAM roles
Answer: To define the maximum available permissions for accounts
Rationale: SCPs establish the maximum permissions that IAM identities in
affected accounts can use. They do not directly grant permissions.
9. Does an SCP grant permissions to an IAM user?
A. Yes, always
B. Yes, but only in the management account
C. No
D. Only when MFA is enabled
Answer: No
Rationale: SCPs do not grant permissions. An identity still requires an applicable
IAM identity-based or resource-based permission, subject to the SCP boundary.
10.If an IAM policy allows an action but an applicable SCP explicitly denies it,
what happens?
A. The IAM policy overrides the SCP
B. The SCP denial takes precedence
C. The action is allowed automatically
D. AWS ignores both policies
Answer: The SCP denial takes precedence
Rationale: An explicit deny in an SCP prevents the affected account's identities
from performing the denied action, even when IAM policies allow it.
11.Which account is not restricted by SCPs in the same way as member
accounts?
