ANS-C01 Network Security, Compliance and Governance Practice Question
A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no EC2 instance in any account can be launched with a public IP address unless it is in a specific VPC. Which solution will meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.
An SCP applied at the root OU can deny ec2:RunInstances when the request includes a public IP address, using the ec2:AssociatePublicIpAddress condition key, and can further limit based on VPC using conditions like ec2:Vpc. This centrally prevents non-compliant EC2 launches across all accounts. Option B is incorrect because IAM policies must be attached to each user/role individually and do not scale across accounts; SCPs are designed for this purpose. Option C is incorrect because AWS Config can detect non-compliant instances but cannot prevent the initial launch. Option D is incorrect because CloudWatch Events can trigger actions after launch but does not prevent the launch itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a service control policy (SCP) that denies ec2:RunInstances if the request includes an association with a public IP address, unless the VPC is the allowed one.
Why this is correct
Correct: SCPs can enforce restrictions across all accounts in the organization.
- ✗
Create an IAM policy that denies ec2:RunInstances if the subnet is not in the allowed VPC, and attach it to all IAM users.
Why it's wrong here
Wrong: IAM policies are per-account and not organization-wide.
- ✗
Enable AWS CloudTrail and create a CloudWatch Events rule to stop any instance with a public IP.
Why it's wrong here
Wrong: CloudTrail logs, does not prevent.
- ✗
Use AWS Config rules to detect non-compliant instances and automatically terminate them.
Why it's wrong here
Wrong: Config detects after launch, does not prevent.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.