SOA-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?
⚠ Common exam trap
Many exam-takers confuse IAM policies (which are identity-based and account-specific) with SCPs (which are account-wide and centrally managed), leading them to choose Option A because they think attaching a deny policy to users is sufficient, but they overlook that SCPs provide the only centralized, preventive control across multiple accounts in AWS Organizations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.
Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.
Why it's wrong here
While this could work, it requires deploying the policy in each account individually and attaching it to all principals, which is not centrally managed. It is also easy to miss new users. SCPs provide a centralized, organization-wide control.
- ✓
Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.
Why this is correct
SCPs are a centralized way to set permission boundaries for all accounts in the organization. By denying EC2 actions via SCP on non-production OUs, the restriction is enforced even for the root user of those accounts, and it applies to all IAM principals.
- ✗
Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.
Why it's wrong here
AWS Config is a detective service that evaluates resource configurations after they have been created. A Config rule can detect non-compliant EC2 usage and trigger a remediation action to terminate instances, but this happens after the resource exists, leaving a window where compute resources are already provisioned and incurring cost. It also requires per-account setup of rules unless you use aggregation, and it does not prevent any principal—including the root user—from launching EC2 instances in the first place. Therefore, it is reactive and not an effective preventive control like a service control policy.
- ✗
Create a resource-based policy on each EC2 instance that denies access from non-production accounts.
Why it's wrong here
EC2 instances do not support resource-based policies; these are only available for services like S3, SNS, SQS, and KMS that have a resource model allowing inline access policies. Even if an EC2 instance could have a resource policy, it would be evaluated only when a request is made to that specific instance, so it cannot block RunInstances requests or prevent new instances from being launched. Managing per-instance policies across many non-production accounts is also operationally unscalable and completely bypassed by IAM users, roles, or the root user that has permissions to modify or delete the policy. Thus, this approach is neither technically valid nor centrally controlled.
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 247-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.