SCS-C02 Management and Security Governance Practice Question
A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.
Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles. Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role. Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case. Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an SCP to require that all EC2 instances have an IAM role attached.
Why it's wrong here
SCPs can require a role but cannot restrict which role; users could attach any role.
- ✓
Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.
Why this is correct
This policy condition ensures that only instances with an approved IAM role can be launched.
- ✗
Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.
Why it's wrong here
SCPs cannot use resource-level conditions like ec2:InstanceProfile; they operate at the API action level without resource ARN specificity.
- ✗
Use AWS Config to detect instances without a role and automatically terminate them.
Why it's wrong here
This is reactive, not preventive; also termination may cause data loss.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.