A company manages multiple AWS accounts under AWS Organizations. The security team wants to enforce a policy that prohibits launching Amazon EC2 instances of instance families g (GPU) and p (GPU) across all accounts to control costs. The team needs a centralized method to block these instance types at the organization level, and the policy must be applied proactively before any instance is launched. Which AWS solution should the team use?

Create an AWS IAM policy with a Deny effect for ec2:RunInstances where the instance type starts with 'g' or 'p' and attach it to a specific IAM role in each account.

This approach is not centralized and requires manual IAM policy configuration in every account. It can also be bypassed if users assume roles that do not have the policy attached. SCPs provide a single, enforceable boundary across all accounts.

Use an AWS Config managed rule to detect GPU instance launches and trigger an auto-remediation action that terminates the instances.

AWS Config is a detective control and can only react after the instance is already launched. Auto-remediation can terminate it, but this may incur costs for the brief period the instance runs and wastes resources. The requirement is for a proactive, preventive policy.

Use AWS Trusted Advisor cost optimization checks to identify GPU instances and then manually disable them in each account.

Trusted Advisor provides recommendations and cost-saving suggestions, but it cannot enforce policies or block resource creation. It is an advisory tool, not a preventive control mechanism.

What does this CLF-C02 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Apply an AWS Organizations Service Control Policy (SCP) that denies ec2:RunInstances when the requested instance type belongs to the g or p families. — To centrally and proactively block specific EC2 instance types across all accounts in an AWS Organization, the best solution is an AWS Organizations Service Control Policy (SCP). An SCP can be attached to the root organizational unit or to specific accounts to deny the ec2:RunInstances action when the instance type matches the prohibited families. This is a preventive control that takes effect before the resource is created. Other options are less suitable because they either require per-account configuration, are detective (not preventive), or only provide recommendations without enforcement.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.