DOP-C02 Configuration Management and IaC Practice Question
A DevOps engineer wants to ensure that all EC2 instances launched in an AWS account automatically have a specific set of tags applied for cost allocation. Which AWS service should they use to enforce this?
⚠ Common exam trap
Candidates often confuse AWS Config's evaluation and remediation capabilities with the tagging features of EC2 Auto Scaling or CloudFormation, mistakenly thinking those services can enforce tags on all instances account-wide, when they only apply to resources they directly manage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is correct because it can enforce tagging rules through managed rules like `required-tags` or custom AWS Config rules using AWS Lambda. When an EC2 instance is launched without the required tags, AWS Config can evaluate the resource against the rule and trigger remediation actions (e.g., via AWS Systems Manager Automation) to automatically apply the tags or flag non-compliance. This ensures consistent cost allocation tagging across all instances without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Service Catalog
Why it's wrong here
AWS Service Catalog is a governance service that can enforce tag options only on resources it provisions through portfolio products; when an EC2 instance is launched from a Service Catalog product, the product's tag options are applied to the resulting stack and its resources. However, this enforcement is scoped exclusively to catalog-provisioned products. Any EC2 instance created directly via the EC2 console, AWS CLI, SDK, or other services like AWS Lambda or ECS is completely outside Service Catalog's control, so it cannot ensure that all EC2 instances in the account are tagged.
- ✓
AWS Config
Why this is correct
AWS Config is the correct choice because it provides a continuous, account-wide compliance evaluation of resource configurations. You can use the managed AWS Config rule 'required-tags' (or a custom Lambda-backed rule) to check that every EC2 instance has the mandatory tags, and the rule can be paired with an auto-remediation action, such as an SSM Automation document, to automatically add missing tags. Since AWS Config records every EC2 instance as a configuration item and re-evaluates on configuration changes, it can both detect and enforce tag compliance for all existing and newly launched instances, regardless of how they were created.
- ✗
Amazon EC2 Auto Scaling
Why it's wrong here
Amazon EC2 Auto Scaling can tag instances it launches on behalf of an Auto Scaling group, and it supports tag propagation and tag specifications in launch templates, but its influence is limited to instances that belong to that Auto Scaling group. It has no mechanism to discover, evaluate, or modify tags on instances that were launched manually, through the EC2 RunInstances API, or by other orchestration services. Consequently, Auto Scaling cannot guarantee that every EC2 instance in the account is tagged; it only manages tags on the subset it launches.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation can apply stack-level tags or resource-level tags to the EC2 instances it creates from a template, and the Tags property on AWS::EC2::Instance allows you to define tags declaratively. However, CloudFormation's tagging applies only to resources it manages within that stack. An instance launched directly through the console or any other API is not part of a CloudFormation stack, so CloudFormation has no involvement and cannot enforce or verify tagging on those resources, making it unsuitable for a blanket account-wide tagging policy.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.