SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates choose a Deny-based approach (Option D) thinking it is more secure, but they overlook that without an explicit Allow, the implicit deny blocks all actions, and the Deny condition does not enforce the tagging requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.
The IAM policy condition 'ec2:RequestTag/CostCenter' ensures that the developer's RunInstances request includes the required 'CostCenter' tag, enforcing tagging compliance at launch time. Option B is correct because a condition using 'ec2:InstanceType' with a 'ForAllValues:StringLike' or 'StringEquals' operator restricts allowed instance types to a specific list, preventing unauthorized instance families or sizes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.
Why this is correct
This ensures tagging is enforced.
- ✓
Allow ec2:RunInstances with a condition that the instance type is in an allowed list.
Why this is correct
This restricts instance types.
- ✗
Allow ec2:RunInstances without conditions.
Why it's wrong here
This would allow all instances.
- ✗
Deny ec2:RunInstances if the instance type is not in the allowed list.
Why it's wrong here
This is a deny statement, but combined with an allow, it can be redundant; better to use allow with condition.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.