SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?
⚠ Common exam trap
It's easy for candidates to confuse AWS Service Catalog's tagging enforcement as a global solution, not realizing it only applies to products launched through the catalog, not to direct EC2 API calls across accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.
AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.
Why this is correct
Config rules can enforce tagging compliance.
- ✗
Use AWS Service Catalog to enforce tagging on EC2 products.
Why it's wrong here
Only applies to instances launched through Service Catalog.
- ✗
Use AWS Resource Access Manager to share a tagging policy across accounts.
Why it's wrong here
RAM shares resources, not policies.
- ✓
Apply a service control policy (SCP) that denies ec2:RunInstances if the required tags are not specified.
Why this is correct
SCPs can prevent untagged resources from being created.
- ✗
Use EC2 Auto Scaling lifecycle hooks to add tags automatically.
Why it's wrong here
Not applicable to all instances.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.