SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Lambda function that tags resources after creation.

  Why it's wrong here

  A post-creation Lambda tags resources only after they exist, leaving a window where untagged resources are billed and no guarantee the function runs for every resource type. CloudFormation hooks or service control policies block non-compliant creation outright, which is the required remediation.

• ✗

  Use IAM policies to require tagging on all resource creation.

  Why it's wrong here

  IAM policies can require a CostCenter condition key on tag-on-create API calls, but many CloudFormation-provisioned resource types do not support tag-on-create, so the stack fails rather than being remediated. CloudFormation hooks validate and remediate stack resources directly against the tagging requirement.

• ✗

  Use a CloudFormation stack policy with a deny effect for resource creation without tags.

  Why it's wrong here

  Stack policies govern update actions on existing resources, not tag enforcement at creation, and cannot express a tag-based deny. It is tempting because policies sound like guardrails, but tag remediation requires AWS Config rules or CloudFormation hooks that evaluate resource configuration and trigger automatic remediation.

• ✓

  Use an AWS Config rule with auto-remediation via SSM Automation.

  Why this is correct

  An AWS Config rule evaluates resource configuration continuously, detecting any resource missing the CostCenter tag regardless of which stack created it. Auto-remediation through SSM Automation then applies the tag automatically, satisfying the requirement for automatic remediation across all CloudFormation deployments rather than only at stack creation time.

Go deeper

Related to this question