SAP-C02 Practice Question: Design Solutions for Organizational Complexity
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringNotEquals": {
"ec2:InstanceType": ["t3.micro", "t3.small", "t3.medium"]
}
}
}
]
}Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?
⚠ Common exam trap
Many candidates think `StringNotEquals` is a misconfiguration or that SCPs only apply if the IAM policy also denies, but in reality, an explicit deny in an SCP is absolute and cannot be bypassed by IAM allows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance launch is denied because the SCP denies any instance type not in the allowed list.
The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.
Why it's wrong here
StringNotEquals is evaluated correctly.
- ✓
The instance launch is denied because the SCP denies any instance type not in the allowed list.
Why this is correct
Correct: the deny effect applies when the condition is true.
- ✗
The instance launch is denied, but only if the account's IAM policy also denies it.
Why it's wrong here
SCPs act as a guard; if SCP denies, the action is denied regardless of IAM.
- ✗
The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.
Why it's wrong here
The deny applies when the condition is met; t3.large meets the condition.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.