SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.
SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because service control policies are the right mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.
Why this is correct
SCPs can restrict actions at the account level and are effective for preventive controls.
- ✗
Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.
Why it's wrong here
IAM policies can be bypassed if developers have permissions from other sources.
- ✗
Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.
Why it's wrong here
AWS Config is detective, not preventive.
- ✗
Use AWS Systems Manager to enforce the AMI ID requirement.
Why it's wrong here
Systems Manager does not prevent launch of non-approved AMIs.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?
easy- A.AWS Config rules with auto-remediation
- B.AWS Service Catalog with a portfolio of approved AMIs
- C.AWS Identity and Access Management (IAM) policies in each account
- ✓ D.AWS Organizations Service Control Policies (SCPs)
Why D: AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.
Variation 2. A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?
medium- A.Create an EC2 launch template with the approved AMI and share it with all accounts
- B.Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances
- C.Use AWS Config rules in each account to detect non-compliant instances and send alerts
- ✓ D.Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID
Why D: An SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.