SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config's detective capabilities with preventive controls, or assume IAM policies in individual accounts can be centrally enforced, when only SCPs provide organization-wide preventive enforcement that cannot be bypassed by account-level administrators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.
AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config to detect and delete untagged VPCs.
Why it's wrong here
Reactive, not preventive.
- ✗
Use IAM policies in each account to require tags.
Why it's wrong here
Does not prevent creation via other accounts.
- ✓
Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.
Why this is correct
Prevents creation at the organization level.
- ✗
Use AWS CloudFormation StackSets to deploy VPC templates with tags.
Why it's wrong here
Does not cover console or SDK creation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.