A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?

AWS Config rule with an automatic remediation action that terminates the instance after launch

AWS Config is a detective service that evaluates resource configurations after they are created. Even with automatic remediation, the instance is launched first (even briefly), which may violate the security policy. The requirement is for a preventive control that blocks the launch entirely, and Config does not provide preventive enforcement at the organization level.

IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned

An IAM policy can be written with a condition to deny launch actions that assign a public IP, but IAM policies are applied to specific IAM users or roles within each individual account. They cannot be centrally enforced across all accounts from Organizations. Additionally, IAM policies do not apply to the root user, which could still launch instances with public IPs.

AWS Firewall Manager security group policy

AWS Firewall Manager is used to centrally configure and manage AWS WAF rules, AWS Shield Advanced protections, and VPC security groups across accounts. It does not have the ability to control EC2 launch parameters, such as whether an instance receives a public IP address. It operates at the network security layer, not the instance provisioning layer.

What does this CLF-C02 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Service control policy (SCP) in AWS Organizations — To centrally prevent EC2 instances from being launched with public IPv4 addresses across all accounts in an organization, the most effective and preventive approach is to use a Service Control Policy (SCP) with a deny effect. SCPs are managed at the AWS Organizations level and apply to all IAM users, roles, and the root user in every member account. An SCP can deny the ec2:RunInstances action when the request includes a parameter that assigns a public IP address (e.g., using the condition key 'ec2:AssociatePublicIpAddress'). This policy is enforced before the action is allowed, making it preventive. Other options like AWS Config rules are detective (identify non-compliant resources after creation), IAM policies are per-account and not centrally enforced across all accounts, and AWS Firewall Manager manages security groups and AWS WAF rules, not EC2 launch parameters.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.