A municipal landing zone must apply strict SCPs to production courts accounts while giving experimental AI sandboxes looser guardrails. Which OU design best supports that governance model?
Select an answer to reveal the explanation.
Short Explanation
Courts and a research sandbox are not the same hallway — different locks belong on different wings. Put them in separate OUs so production courts get tight SCPs and AI sandboxes get a different rule set.
Full Explanation
A municipal landing zone that must apply strict SCPs to production courts accounts while giving experimental AI sandboxes looser guardrails should separate those environments into different Organizational Units. Distinct OUs allow distinct SCP sets: courts production inherits tight denies appropriate to justice data, while AI sandboxes receive broader experimentation permissions with compensating detective controls. OU design is how governance expresses the same organization with different risk appetites without writing one blunt policy for everyone.
Placing courts production and AI sandboxes in the same OU so one SCP covers everything forces either unsafe looseness on courts or stifling controls on sandboxes, and neither outcome is acceptable. Disabling Organizations and managing every account with identical IAM users removes OU-based SCP differentiation and centralized guardrails entirely. Attaching the strictest SCP only to individual IAM users inside each sandbox EC2 instance misunderstands SCPs, which apply to accounts and OUs as permission ceilings—not as substitutes for instance instance profiles.
Exam caveat: OUs exist so SCP strategy can differ by environment and data sensitivity; do not put regulated production and experimental sandboxes in one OU if policies must diverge. Operational check: create Courts-Prod and Sandbox-AI OUs, attach different SCP documents, move accounts accordingly, and verify a denied action in courts still succeeds where intended in the sandbox OU.