SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with multiple accounts. The central IT team wants to restrict the use of specific EC2 instance types across all accounts to control costs. Which approach should the team use?
⚠ Common exam trap
It's easy for candidates to confuse IAM policies with SCPs, thinking that attaching a deny policy to the root user or individual IAM users is sufficient, but SCPs are the only mechanism that can enforce restrictions across all principals in an AWS Organization account, including the root user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service control policy (SCP) that denies the ec2:RunInstances action for prohibited instance types and apply it to the organization.
Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts in an AWS Organization. By creating an SCP that denies the ec2:RunInstances action for specific instance types and applying it to the organization (or relevant OUs), the central IT team can enforce this restriction globally, preventing any IAM principal in any account from launching prohibited instance types, regardless of their IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Budgets to send alerts when costs exceed a threshold.
Why it's wrong here
Alerts do not prevent launches.
- ✗
Configure Amazon CloudWatch Events to detect launches and terminate instances.
Why it's wrong here
This is reactive and may incur costs before termination.
- ✗
Attach an IAM policy to each account's root user to deny the ec2:RunInstances action for certain instance types.
Why it's wrong here
IAM policies are per-account and not automatically inherited.
- ✓
Create a service control policy (SCP) that denies the ec2:RunInstances action for prohibited instance types and apply it to the organization.
Why this is correct
SCPs apply to all accounts in the organization.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.