DOP-C02 Security and Compliance Practice Question
A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role can create or modify VPCs, but should allow VPC usage for existing VPCs. Which SCP should be attached to the root OU?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}
It denies both ec2:CreateVpc and ec2:ModifyVpc, preventing creation or modification of VPCs while still allowing other VPC-related actions (like using existing VPCs). Option A denies only ec2:CreateVpc, so users could still modify existing VPCs, which violates the requirement. Option C denies all ec2 actions, which would block the use of existing VPCs entirely, making it too restrictive. Option D denies ec2:CreateVpc and ec2:DeleteVpc but not ec2:ModifyVpc, so VPCs could still be modified, failing to meet the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}
Why it's wrong here
This SCP only denies ec2:CreateVpc. It leaves ec2:ModifyVpc permissible, so administrators could still alter the CIDR block, DNS settings, or default tenancy of an existing VPC. Since the intent is to prevent all configuration changes to VPCs, restricting only creation leaves a critical control gap in the guardrail.
- ✓
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}
Why this is correct
Correct. This policy denies both creating a new VPC and modifying an existing one, while all other EC2 actions remain available. Therefore, users can still run workloads in existing VPCs, but they cannot call CreateVpc or ModifyVpc through any account in the affected OU. This directly enforces the stated guardrail without breaking existing infrastructure.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:*","Resource":"*"}]}
Why it's wrong here
Denying ec2:* is overly broad; it blocks not only VPC changes but also foundational actions like RunInstances, DescribeInstances, and CreateSubnet. Such a policy would effectively freeze all EC2 usage in the OU, likely causing production outages and breaking operational tooling. The requirement is limited to prohibiting VPC creation/modification, not disabling the entire EC2 service.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:DeleteVpc"],"Resource":"*"}]}
Why it's wrong here
This policy denies creation and deletion but omits ec2:ModifyVpc, so an adversary could still change a VPC's CIDR block, enable classic link, or adjust DNS attributes. Furthermore, deletion is not the stated concern; modification is what must be prevented. Since ModifyVpc is the primary action for altering existing VPCs, failing to deny it leaves the SCP ineffective.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,487 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role in any account can create or modify VPCs. Which SCP should be applied to the root OU?
medium- A.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifyVpc","Resource":"*"}]}
- B.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}
- ✓ C.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}
- D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}
Why C: It denies both the ec2:CreateVpc and ec2:ModifyVpc actions, which covers all operations that could create or modify VPCs. A service control policy (SCP) with a Deny effect overrides any Allow permissions, ensuring that no IAM user or role in any account under the root OU can perform these actions, even if attached IAM policies grant them.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.