SCS-C02 Service Control Policy (SCP) Practice Question
Network Topology
Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?
⚠ Common exam trap
Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.
The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive. The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.
Why this is correct
Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.
- ✗
The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.
Why it's wrong here
Incorrect. Allowing inbound HTTPS from RFC 1918 space does not cause an authorization error; it may affect connectivity but not the launch itself.
- ✗
The security group allows outbound all traffic, which violates the principle of least privilege.
Why it's wrong here
Incorrect. Outbound all traffic does not violate any AWS policy that would cause an authorization error; it is a common configuration.
- ✗
The instance type t2.micro is not available in the specified subnet's Availability Zone.
Why it's wrong here
Correct. An SCP can deny specific instance types in certain Availability Zones, leading to an 'UnauthorizedOperation' error despite the user having ec2:RunInstances permission. The error message may appear as 'UnauthorizedOperation' when an SCP denies the action.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.