SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}
It uses a Deny effect with a condition that checks if the 'aws:RequestTag/CostCenter' key is null (i.e., not provided). This policy will deny any RunInstances request that does not include the 'CostCenter' tag, effectively requiring the tag to be present at launch. Option A is incorrect because the 'ec2:CreateAction' condition key is unrelated to tag enforcement; it checks the action type, not the presence of a tag. Option B is incorrect because an Allow policy with a condition does not prevent untagged launches if there are other Allow policies (e.g., a broader Allow without conditions). Option D is incorrect because it denies only when the tag is not equal to a specific value 'MyProject', which does not enforce the presence of the tag but rather a specific value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}
Why it's wrong here
Wrong. This policy denies based on the ec2:CreateAction being null, which is not related to the tag requirement. It does not enforce the presence of the CostCenter tag.
- ✗
{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}
Why it's wrong here
Wrong. An Allow policy with a condition does not block untagged launches; other Allow policies could override this condition.
- ✓
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}
Why this is correct
Correct. This Deny policy with a condition on aws:RequestTag/CostCenter being null ensures that any launch without the CostCenter tag is denied, enforcing the requirement.
- ✗
{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}
Why it's wrong here
Wrong. This Deny policy checks for a specific value 'MyProject', but the requirement is only that the tag exists, not that it has a particular value.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.