SAP-C02 Practice Question: Design Solutions for Organizational Complexity
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"ec2:RunInstances",
"ec2:StartInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringNotEquals": {
"ec2:InstanceType": "t3.micro"
}
}
}
]
}An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?
⚠ Common exam trap
The trap here is that candidates may misinterpret the condition logic, thinking the SCP allows all instance types except t3.micro, when in fact it denies all except t3.micro, causing the m5.large launch to fail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The launch fails because the SCP denies the action.
The SCP explicitly denies the ec2:RunInstances action for any instance type except t3.micro. Since the user attempts to launch an m5.large, the condition does not match, so the default deny applies, and the launch fails. SCPs are evaluated before IAM policies, and an explicit deny in an SCP overrides any allow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The launch succeeds because the condition evaluates to true.
Why it's wrong here
Condition evaluates to true (not equals t3.micro), so deny applies.
- ✗
The launch succeeds because the SCP only denies StartInstances.
Why it's wrong here
The SCP denies both RunInstances and StartInstances.
- ✓
The launch fails because the SCP denies the action.
Why this is correct
The condition matches, so the deny is applied.
- ✗
The launch succeeds because the SCP allows all instance types except t3.micro.
Why it's wrong here
The SCP denies, not allows.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?
hard- A.The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.
- ✓ B.The instance launch is denied because the SCP denies any instance type not in the allowed list.
- C.The instance launch is denied, but only if the account's IAM policy also denies it.
- D.The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.
Why B: The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.