SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?
⚠ Common exam trap
Candidates often confuse SCPs with IAM policies, thinking a deny SCP (Option D) is equivalent to an allow SCP, but AWS evaluates SCPs as allow lists by default, making an explicit allow for specific Regions the correct and simpler approach to enforce Region restrictions without unintended side effects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that allows EC2 actions only in the allowed Regions.
Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.
Why it's wrong here
Permissions boundaries are per-role and need to be applied to each role.
- ✓
Apply an SCP that allows EC2 actions only in the allowed Regions.
Why this is correct
SCPs deny actions by default, so you must explicitly allow only the desired Regions.
- ✗
Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.
Why it's wrong here
Reactive approach; instances can be launched and incur cost before termination.
- ✗
Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.
Why it's wrong here
Denying disallowed Regions is correct, but the answer as written is ambiguous; the best practice is to explicitly allow only allowed Regions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.