easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Enforce that all EC2 instances launched in a…
A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (SCPs) and detective/reactive controls (AWS Config, CloudTrail), and the trap here is that candidates confuse AWS Config's auto-remediation with true enforcement, not realizing that Config only acts after the resource is created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) that requires tags on resource creation.
AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Resource Groups to create a group that filters tagged instances.
Why it's wrong here
Resource Groups organize existing resources but do not enforce tagging.
- ✗
Enable CloudTrail to monitor instance launches and alert on missing tags.
Why it's wrong here
CloudTrail provides audit logs but does not prevent the launch.
- ✓
Apply a service control policy (SCP) that requires tags on resource creation.
Why this is correct
SCPs can use condition keys like aws:RequestTag to require tags, preventing creation of untagged resources.
- ✗
Configure AWS Config rules to automatically tag untagged instances.
Why it's wrong here
Config rules are detective/corrective, not preventive.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.