SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an SCP that denies ec2:RunInstances when the condition iam:InstanceProfile is not set to the required profile ARN.

  Why this is correct

  This SCP is correct because it applies at the organization level to all member accounts and uses the global IAM condition key iam:InstanceProfile to require a specific instance profile ARN. The deny rule blocks any ec2:RunInstances call from any principal—user, role, or service—that does not include the required profile in its parameters. The condition key is evaluated exactly and provides a preventive guardrail that cannot be bypassed by user-specific policy exceptions.

• ✗

  Attach an IAM policy to all users that denies ec2:RunInstances unless an instance profile is specified.

  Why it's wrong here

  This approach is insufficient because user-level IAM policies only govern authenticated users, not IAM roles, service-linked roles, or AWS services that assume roles on your behalf, so an EC2 instance can still be launched without the profile via a role or a service like CloudFormation. More fundamentally, a user policy can be overridden by a role's permissions, and it does not set an organization-wide guardrail. Additionally, maintaining such a policy across every existing and future user is operationally fragile compared to a single SCP at the root.

• ✗

  Create an SCP that denies ec2:RunInstances when the condition ec2:InstanceProfile is not set.

  Why it's wrong here

  This SCP would fail because there is no service-specific condition key named ec2:InstanceProfile in the EC2 action's condition context; the correct key is the global condition key iam:InstanceProfile. If a policy references an invalid condition key, that condition evaluates to false in the request context, so the deny is not triggered and the action is allowed. Thus, using ec2:InstanceProfile would silently make the SCP ineffective, and the missing condition could not enforce the required instance profile ARN.

• ✗

  Use AWS Config rule ec2-instance-profile-attached to detect non-compliant instances and automatically terminate them.

  Why it's wrong here

  An AWS Config rule is purely detective: it evaluates launched resources after the fact, and automatic termination requires a separate custom remediation or a Lambda function, meaning no denial occurs at the moment of RunInstances. The required rule only reports non-compliance and cannot by itself prevent the instance from being created. Additionally, automatically terminating instances based on a Config rule is risky because it may disrupt legitimate workloads, has a time delay, and cannot enforce a mandatory profile ARN value, only the presence of a profile.

Go deeper

Related to this question