An AWS Organization has an SCP at the root that allows IAM users to be created. DevOps must be able to create IAM users with any level of permissions and must be able to prevent other users from creating IAM users. Developers should be able to create IAM users but must not be able to grant excessive permissions. Developers have a CreateAndManageUsers role in each account. Which combination of steps will meet these requirements? (Choose two.)

The "PermissionBoundaries" policy defines the maximum permissions a developer can grant to new IAM users, ensuring they cannot create users with excessive privileges. This directly addresses the requirement for developers to create users without granting excessive permissions. The "DeveloperBoundary" policy, when attached to the "CreateAndManageUsers" role, grants developers the necessary permissions to create IAM users and attach policies, but critically, it enforces the use of "PermissionBoundaries" as a permissions boundary. This combination ensures developers can perform their tasks within defined limits. The incorrect options either deny all users the ability to create/modify IAM users (which prevents DevOps from doing their job), or incorrectly define the purpose of the "PermissionBoundaries" policy as allowing user creation rather than defining permission limits. The SCP option is also incorrect because SCPs cannot enforce permission boundaries on IAM user creation directly in the way required.