CLF-C02 Billing, Pricing, and Support Practice Question

A company wants to implement governance controls that prevent their developers from provisioning expensive instance types. Which approach is most effective?

⚠ Common exam trap

Many exam-takers confuse reactive cost management tools (like budgets and Cost Explorer) with proactive governance controls, assuming alerts or recommendations can prevent actions rather than just monitor or advise.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply an SCP or IAM policy that denies launching specific expensive instance types

Service Control Policies (SCPs) or IAM policies can explicitly deny the launch of specific expensive instance types (e.g., `p3.2xlarge` or `x1e.32xlarge`) at the API level, preventing the action before any resources are created. This proactive governance approach enforces compliance in real time, unlike reactive or advisory methods. By attaching a deny effect for `ec2:RunInstances` with a condition on `ec2:InstanceType`, the policy blocks unauthorized instance provisioning regardless of the user's role or account.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set an AWS Budget alert for when expensive instances are launched
Why it's wrong here
AWS Budgets are a monitoring and alerting service, not an enforcement mechanism. A budget alert can notify you when your actual or forecasted spending exceeds a threshold, but it fires after the cost has been incurred or is about to be incurred, so it cannot stop an expensive instance from being launched. To actually prevent the launch, you need an identity-based policy (IAM) or an organization-level service control policy (SCP) with a deny effect.
✓
Apply an SCP or IAM policy that denies launching specific expensive instance types
Why this is correct
This is a preventive control because it denies the action before it happens. In IAM, you can attach a policy with a Condition that uses the ec2:InstanceType key to deny the ec2:RunInstances action for specific expensive types, such as p4d.24xlarge. At the organization level, an SCP with the same condition can enforce this across all child accounts, and it cannot be overridden by the account's own IAM policies. For an SCP to be effective, the root user must not be able to bypass it, which is the case for IAM-user actions.
✗
Enable AWS Cost Explorer recommendations
Why it's wrong here
Cost Explorer's rightsizing recommendations are based on analyzing your existing usage patterns and cloudWatch metrics to suggest more cost-effective instance types. This process necessarily requires that instances already exist and have accumulated enough data, so it cannot prevent an expensive launch. It is a cost-optimization tool for the detection phase, not a control to block future launches.
✗
Enable Trusted Advisor and review weekly
Why it's wrong here
AWS Trusted Advisor performs automated checks and provides recommendations after your resources are already provisioned. For example, the Amazon EC2 Reserved Instance Optimization check identifies underutilized instances after they have been running for some period, but it does not intercept any API calls to prevent a new expensive launch. This makes it a reactive, not a preventive, cost-control measure.

Go deeper

CLF-C02 Billing, Pricing, and Support Practice Question

Why each option matters

Option-by-option breakdown

Related to this question