SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?
⚠ Common exam trap
Candidates often confuse detective controls (AWS Config) or account-level features (Block public access) with preventive controls, and underestimating that IAM policies can be circumvented by privileged users or service-linked roles, whereas SCPs apply to all principals in the account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.
A service control policy (SCP) attached to the production OU can deny the ec2:RunInstances action when the request includes the AssociatePublicIpAddress=true parameter. This is a preventive control that applies to all accounts in the OU, regardless of IAM permissions, and does not rely on developer compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Amazon EC2 'Block public access' feature at the account level.
Why it's wrong here
EC2 Block public access is not a feature; S3 has Block Public Access.
- ✗
Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.
Why it's wrong here
IAM policies may not cover all scenarios (e.g., service-linked roles).
- ✗
Use AWS Config to detect instances with public IPs and automatically terminate them.
Why it's wrong here
Detective/reactive, not preventive.
- ✓
Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.
Why this is correct
SCPs are preventive and cannot be overridden by IAM policies within the account.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?
medium- A.An IAM policy applied to each account's admin role to restrict instance types.
- B.An SCP that allows ec2:RunInstances only for t2.micro.
- ✓ C.An SCP that denies ec2:RunInstances when the instance type is not t2.micro.
- D.An AWS Config rule to terminate non-compliant instances.
Why C: An SCP that denies ec2:RunInstances when the instance type is not t2.micro will prevent launching any instance type other than t2.micro. SCPs are centralized and can be applied to OUs. Option A is incorrect because IAM policies are per-account and not centralized. Option B is incorrect because an allow SCP by itself would only allow t2.micro but would not prevent other instance types unless the default is to deny all, which is not the case. Option D is incorrect because AWS Config rules are reactive and do not prevent actions; they only detect and can remediate after the fact.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.