SCS-C02 Management and Security Governance Practice Question
A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.
AWS Config rules can detect EC2 instances that are missing the required tag and trigger an automatic remediation action via a Lambda function to terminate them, providing a fully automated solution with minimal effort. Option A is wrong because SCPs cannot enforce tagging on individual EC2 instances at launch time; they can only deny actions based on conditions, but tagging conditions are not supported for ec2:RunInstances. Option B is wrong because AWS Organizations Tag Policies enforce tagging on resources but do not automatically remediate non-compliant resources; they only prevent creation of resources without tags if applied at the service level, which is not the case here. Option D is wrong because CloudTrail logs events but cannot automatically terminate instances; it would require manual intervention or additional automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an SCP to deny ec2:RunInstances if the request does not include the required tag.
Why it's wrong here
SCPs can deny API calls, but tagging conditions are complex and may not catch all cases.
- ✗
Use AWS Organizations Tag Policies to enforce the tag.
Why it's wrong here
Tag Policies enforce tags on resources that support them, but they do not auto-terminate noncompliant resources.
- ✓
Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.
Why this is correct
Config can detect untagged instances and auto-remediate by terminating them.
- ✗
Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.
Why it's wrong here
Alerts require manual action.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.