SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?
⚠ Common exam trap
Many exam-takers confuse IAM policies with SCPs, thinking that account-level IAM policies are sufficient for centralized enforcement, but they fail to recognize that SCPs are the only mechanism that can restrict even the root user and cannot be overridden by account administrators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.
Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that denies EC2:RunInstances in non-approved regions, you enforce a guardrail that applies to all IAM users and roles in the member accounts, regardless of their individual IAM policies. This is the most effective approach because SCPs are evaluated before IAM policies and cannot be overridden by account administrators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config rules to detect EC2 instances in non-approved regions and trigger automatic termination.
Why it's wrong here
Reactive; does not prevent launch.
- ✗
Create IAM policies in each account that deny EC2 actions outside approved regions.
Why it's wrong here
Requires maintenance in each account.
- ✗
Use VPC endpoints to restrict API calls to approved regions.
Why it's wrong here
VPC endpoints do not control regional access.
- ✓
Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.
Why this is correct
SCPs are applied at the OU or account level and prevent actions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.