CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that no Amazon EC2 instance can be launched with a public IPv4 address in any member account. The team needs a preventive control that centrally blocks the launch action if a public IP is assigned, and the control must automatically apply to all existing and future accounts in the organization. Which AWS feature should the security team use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse SCPs with IAM policies, not realizing that SCPs are the only mechanism in AWS Organizations that can centrally and preventively restrict actions across all accounts, including future ones, without requiring per-account configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service control policy (SCP) in AWS Organizations
Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum available permissions for all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action when the request includes a public IP address assignment (using the ec2:AssociatePublicIpAddress condition key), you can prevent any EC2 instance from being launched with a public IPv4 address. This control applies automatically to all existing and future member accounts without requiring per-account configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config rule with an automatic remediation action that terminates the instance after launch
Why it's wrong here
AWS Config is a detective service that evaluates resource configurations after they are created. Even with automatic remediation, the instance is launched first (even briefly), which may violate the security policy. The requirement is for a preventive control that blocks the launch entirely, and Config does not provide preventive enforcement at the organization level.
When this WOULD be correct
This option would be correct if the requirement was to detect and automatically remediate non-compliant resources after they are created, rather than prevent the launch action entirely. For example, a question asking for a post-launch compliance check that terminates unauthorized public IP instances.
- ✗
IAM policy with a condition key to deny ec2:RunInstances when a public IP is assigned
Why it's wrong here
An IAM policy can be written with a condition to deny launch actions that assign a public IP, but IAM policies are applied to specific IAM users or roles within each individual account. They cannot be centrally enforced across all accounts from Organizations. Additionally, IAM policies do not apply to the root user, which could still launch instances with public IPs.
When this WOULD be correct
This option would be correct if the question asked for a preventive control within a single AWS account (not across an organization) to deny launching EC2 instances with public IPs, using an IAM policy with a condition key on ec2:RunInstances.
- ✓
Service control policy (SCP) in AWS Organizations
Why this is correct
An SCP can be attached to the root organizational unit (OU) or the entire organization to deny the ec2:RunInstances action when the request includes a parameter for a public IP address (e.g., condition key 'ec2:AssociatePublicIpAddress'). SCPs are preventive policies that apply to all principals (including the root user) in all member accounts, and they are automatically inherited by new accounts added to the organization. This meets all the requirements.
- ✗
AWS Firewall Manager security group policy
Why it's wrong here
AWS Firewall Manager is used to centrally configure and manage AWS WAF rules, AWS Shield Advanced protections, and VPC security groups across accounts. It does not have the ability to control EC2 launch parameters, such as whether an instance receives a public IP address. It operates at the network security layer, not the instance provisioning layer.
When this WOULD be correct
A company needs to centrally enforce that all EC2 instances in an AWS Organization must have a specific set of security group rules (e.g., no SSH from 0.0.0.0/0) and automatically remediate non-compliant security groups across all accounts. Firewall Manager security group policies would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service control policy (SCP) in AWS OrganizationsCorrect answer▾
Why this is correct
An SCP can be attached to the root organizational unit (OU) or the entire organization to deny the ec2:RunInstances action when the request includes a parameter for a public IP address (e.g., condition key 'ec2:AssociatePublicIpAddress'). SCPs are preventive policies that apply to all principals (including the root user) in all member accounts, and they are automatically inherited by new accounts added to the organization. This meets all the requirements.
✗AWS Config rule with an automatic remediation action that terminates the instance after launchWrong answer — click to see why▾
Why this is wrong here
AWS Config rules with automatic remediation are detective and reactive, not preventive. They terminate the instance after launch, which does not block the launch action itself and may incur costs or resource usage before termination.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to detect and automatically remediate non-compliant resources after they are created, rather than prevent the launch action entirely. For example, a question asking for a post-launch compliance check that terminates unauthorized public IP instances.
Why candidates choose this
Candidates may think that automatic remediation provides a 'preventive' effect by quickly terminating instances, but they overlook the key distinction between preventive (blocking the action) and detective/reactive (responding after the fact) controls.
✗IAM policy with a condition key to deny ec2:RunInstances when a public IP is assignedWrong answer — click to see why▾
Why this is wrong here
IAM policies are account-level and cannot be centrally applied across all accounts in an AWS Organization. They must be attached individually to each account, and they do not automatically apply to new accounts.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a preventive control within a single AWS account (not across an organization) to deny launching EC2 instances with public IPs, using an IAM policy with a condition key on ec2:RunInstances.
Why candidates choose this
Candidates may think IAM policies can centrally control actions across accounts, but they are per-account; SCPs are the organization-wide preventive control.
✗AWS Firewall Manager security group policyWrong answer — click to see why▾
Why this is wrong here
AWS Firewall Manager security group policies manage security group rules across accounts, but they do not prevent EC2 instances from being launched with public IPv4 addresses. They are not a preventive control for blocking launch actions based on public IP assignment.
★ When this WOULD be the correct answer
A company needs to centrally enforce that all EC2 instances in an AWS Organization must have a specific set of security group rules (e.g., no SSH from 0.0.0.0/0) and automatically remediate non-compliant security groups across all accounts. Firewall Manager security group policies would be the correct choice.
Why candidates choose this
Candidates may think Firewall Manager provides centralized security controls across accounts, but they confuse its capability to manage security groups with the ability to block resource launches based on network configuration.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.