Courseiva
← SAP-C02
Full test
Design Solutions for Organizational Complexity →hardMultiple ChoiceObjective-mapped

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": [
            "t3.micro",
            "t3.small"
          ]
        }
      }
    }
  ]
}

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

⚠ Common exam trap

Many candidates assume SCPs apply globally once created, but they must be explicitly attached to the target OU, account, or root to take effect.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The SCP is not attached to the correct OU or root

The most likely reason is that the SCP is not attached to the correct OU or root. SCPs must be explicitly attached to the target OU, account, or root to take effect. If the SCP is attached to a different OU or not attached at all, it will not restrict the accounts in the intended OU, allowing users to launch any instance type.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The SCP syntax is invalid because it uses StringNotEquals

    Why it's wrong here

    StringNotEquals is a valid condition operator.

  • ✗

    The SCP must also allow the allowed instance types in a separate statement

    Why it's wrong here

    SCPs are deny-only; allowing is not needed.

  • ✗

    The SCP does not include an Allow statement for the allowed instance types

    Why it's wrong here

    SCPs are deny-only; they do not require Allow statements.

  • ✓

    The SCP is not attached to the correct OU or root

    Why this is correct

    If the SCP is not attached to the OU containing the accounts, it will not take effect.

About these practice questions

Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

hard
  • A.Full access to all AWS services because no SCP is applied to the DevAccount.
  • ✓ B.Nothing, because the management account's SCP applies to all accounts.
  • C.Only read-only actions because of default SCP.
  • D.Only actions allowed by the root user's implicit full access.

Why B: SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.

Variation 2. Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

hard
  • A.The production account's IAM policy denies s3:DeleteBucket.
  • B.The SCP only applies to the management account.
  • ✓ C.The SCP applies to the production account because it is attached to the root.
  • D.The production account is the management account.

Why C: SCPs are applied to all accounts in the organization when attached to the root, including the production account. The SCP denying s3:DeleteBucket is an effective deny that overrides any allow in IAM policies, so the production account's administrator cannot delete the bucket regardless of their IAM permissions.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.