As an AWS expert, create flashcards in this format according to the guielindes and examples based on the info below. Follow the guidelines and format STRICTLY:

Format:
create anki flashcards in this format:
First the front of the card is written in plain text, Put a ; at the end. The front of the card should contain the question along with multiple choices labelled from A to D, each on a new line. Then the answer should be the correct choice alphabet only and be put after a space. For example, Question; “Answer”.

Guidelines:
Formulate questions like it is done in the AWS Security Specialty certification exam
Do not generate Yes/No flashcards AT ALL!
Do not generate all of the above or not mentioned choices!
Make flashcards only on the most important information.
Make sure the questions are clear and easy to understand
Make the answers very concise and about a single concept or fact
Do not add the examples below as part of the answer
Start each flashcard on a new line WITHOUT list numbers or bullet points


Examples:

Where is the Dead Sea located? 
A. Egypt 
B. Lebanon 
C. Nigeria 
D. on the border between Israel and Jordan; D

Info:

Management account is not affected by SCPs whether they are attached directly or indirectly

Only SCPs can restrict the root user of an account.

When SCPs are setup, active policies in an account are the ones allowed by both identity policy and SCP

Control Tower has a dashboard for managing settings

Control Tower is concerned with security by the security OU which creates Audit accounts and log archive accounts

Regions can be restricted by the landing Zone in control tower

Landing zone provides SSO for ID federation

Service catalog can be used to provision new accounts within the landing zone

Network standard configuration for accounts can be done by the Account Factory in Control Tower

Iam:passrole when used in a policy "action" block allows the user to use an already existing role as well as all permissions contained in the role.

Temporary credentials generated by STS can only be expired and not cancelled

Roles effect can only be revoked by applying a deny policy to the role, and not by deleting or manually expiring them

A major managed policy to be applied is AWSRevokrOlderSessions where deny policies apply to sessions older than the current  

Ec2 instances can be stopped and started again to regenerate temporary credentials that had been revoked.

IAM policy variables are used to interpolate strings (for example iam user strings) in policies. They are mainly used in resource section (after the 5th column of the arn), and in conditons column.


END
END