SOA-C02 Security and Compliance Practice Question
A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?
⚠ Common exam trap
A common mix-up: candidates think CloudTrail and CloudWatch Events alone can enforce tag compliance, but they lack the evaluation logic and automated remediation that AWS Config with a custom Lambda rule provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config with a custom rule and AWS Lambda
AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config with a custom rule and AWS Lambda
Why this is correct
A custom AWS Config rule can evaluate EC2 instances when they are created (configuration change trigger) and invoke an AWS Lambda function to terminate instances lacking the required tag or having an invalid value. This provides continuous compliance enforcement.
- ✗
AWS CloudTrail and Amazon CloudWatch Events
Why it's wrong here
CloudTrail logs API calls, and CloudWatch Events can trigger a Lambda function on the RunInstances event to check tags and terminate if needed. While this can work for new launches, it does not provide ongoing compliance monitoring for tag changes after launch, and it requires more custom logic than using AWS Config.
- ✗
AWS Service Catalog and AWS Organizations
Why it's wrong here
AWS Service Catalog can enforce tag constraints only on resources that are provisioned through its own product portfolios. Any EC2 instance launched directly via the console, CLI, SDK, or an Auto Scaling group bypasses Service Catalog entirely, so the security team’s tag requirement would not be applied. AWS Organizations is purely an account management and policy governance service; it does not have native EC2 tag enforcement capabilities, nor can it terminate untagged instances. Therefore, this combination does not provide the continuous, instance-level compliance enforcement promised by AWS Config plus Lambda.
- ✗
Amazon Inspector and AWS Systems Manager
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and network exposure; it has no mechanism to read EC2 tags or enforce tagging policies. AWS Systems Manager offers operational features like patch management, session manager, and state manager, but while System Manager can run scripts via Run Command or documents, it is not designed as a tag-compliance engine and would require extensive custom automation to evaluate tags and terminate instances. Moreover, neither service triggers automatically on instance creation or tag changes in the same native, event-driven way as AWS Config's configuration change trigger. This pairing targets operational health and security posture, not tag governance, so it fails the requirement to enforce tags on all EC2 instances.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?
medium- ✓ A.AWS Config with the 'required-tags' managed rule and Amazon SNS
- B.Amazon CloudWatch Events with an EC2 instance state change rule and AWS Lambda
- C.AWS Trusted Advisor with a custom check
- D.Amazon Inspector with a network assessment
Why A: AWS Config's 'required-tags' managed rule continuously evaluates EC2 instances against the specified tag key and allowed values, triggering an SNS notification when non-compliant resources are detected. This provides automated detection and alerting with minimal operational overhead, as it requires no custom code or infrastructure management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.