SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently think AWS Service Catalog or CloudFormation Guard can enforce organization-wide AMI restrictions, but they lack the ability to block direct API calls across all accounts without an SCP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Share the approved AMIs from the central account with all other accounts.
Sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Share the approved AMIs from the central account with all other accounts.
Why this is correct
Necessary so that accounts can launch from those AMIs.
- ✗
Use AWS CloudFormation Guard to validate templates before deployment.
Why it's wrong here
Guard is for infrastructure as code, not for runtime enforcement.
- ✓
Apply an SCP that denies ec2:RunInstances with a condition that the image owner is not the central account.
Why this is correct
This prevents launching instances with non-approved AMIs.
- ✗
Use AWS Service Catalog to create a product for approved AMIs.
Why it's wrong here
Service Catalog doesn't enforce AMI usage across all accounts directly.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.