SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with multiple accounts. The central IT team wants to enforce that all EC2 instances are launched with specific tags (e.g., CostCenter and Environment). The solution should prevent any untagged instances from being created. Which approach should be taken?
⚠ Common exam trap
Many candidates choose a detective solution (like AWS Config with Lambda) because it seems automated, but the question explicitly requires a preventive control that blocks creation, which only SCPs can achieve at the organizational level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.
AWS Organizations SCPs can centrally enforce tag requirements by denying the ec2:RunInstances action when required tags are not specified in the request. While IAM policies can also use condition keys like aws:RequestTag to enforce tags, managing individual IAM policies across many accounts is less efficient and harder to maintain. SCPs provide a preventive control that applies to all principals in an account, ensuring consistent enforcement without relying on detection and remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Service Catalog to provision EC2 instances only from pre-configured products that include required tags.
Why it's wrong here
Service Catalog constrains provisioning only to users who launch through its products; instances created directly via the EC2 API, CLI or CloudFormation bypass it and remain untagged. It is tempting because portfolios embed tags in the product template, and it would be correct for standardising self-service deployments, not enforcing tags across all launches.
- ✗
Use an AWS Config rule to detect untagged instances and trigger a Lambda function to terminate them.
Why it's wrong here
An AWS Config rule evaluates resources after they exist, so the Lambda terminates instances only post-launch, leaving a window where untagged instances run and incur cost. It is tempting because Config gives organisation-wide detection, and it would be correct for remediating drift rather than preventing creation.
- ✓
Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.
Why this is correct
SCPs set the maximum permissions for member accounts and are evaluated before IAM, so a deny on ec2:RunInstances with a Null condition on aws:RequestTag keys blocks untagged launches organisation-wide, satisfying the requirement to prevent creation rather than merely detect it afterwards.
- ✗
Create an IAM policy for each account that requires tags on instance creation.
Why it's wrong here
While IAM policies can enforce tags at launch time using condition keys like aws:RequestTag, this approach is not centrally enforced. Each account would need its own policy, and account administrators could modify or bypass it. Therefore, it is not the best solution for organizational-level enforcement.
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.