SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?
⚠ Common exam trap
Test-takers frequently confuse detective controls (AWS Config) with preventive controls (SCPs), assuming detection and remediation are as scalable as prevention, but SCPs block the action before it happens, which is the most scalable and least disruptive approach for 500 accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.
An SCP applied at the root or OU level can deny ec2:RunInstances unless the ec2:ImageId matches a specific set of allowed AMIs. This scales to 500 accounts without per-account configuration, as SCPs are inherited by all accounts in the organization. The condition key ec2:ImageId supports wildcard patterns or a list of AMI IDs, making it a centralized, preventive control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply an SCP that denies ec2:RunInstances with a condition on ec2:ImageId.
Why this is correct
SCP applies to all accounts in the organization.
- ✗
Use AWS Config to detect non-compliant AMIs and stop the instances.
Why it's wrong here
Reactive and requires per-account setup.
- ✗
Create a service catalog product for EC2 with allowed AMIs.
Why it's wrong here
Does not prevent direct EC2 launch.
- ✗
Use AWS Systems Manager to enforce AMI compliance.
Why it's wrong here
Systems Manager can patch but not prevent launch of non-compliant AMIs.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.