An enterprise has a strict compliance requirement: no Amazon EC2 instances can be launched without a specific set of tags (CostCenter and ProjectID). If a user attempts to launch an instance without these tags, the launch must be blocked immediately. How can the Solutions Architect enforce this across the entire AWS Organization?

Answer options:

Use AWS Config with the required-tags managed rule and enable automatic remediation to terminate non-compliant instances.

Create a Service Control Policy (SCP) that denies ec2:RunInstances if the required tags are not present.

Use AWS CloudTrail to monitor for RunInstances events and trigger a Lambda function to stop the instance.

Configure Tag Policies in AWS Organizations to enforce the tags.

How to approach this question

Look for proactive enforcement (SCPs) rather than reactive (Config/CloudTrail).

Full Answer

B.Create a Service Control Policy (SCP) that denies ec2:RunInstances if the required tags are not present.✓ Correct

Create a Service Control Policy (SCP) that denies ec2:RunInstances if the required tags are not present.

Service Control Policies (SCPs) can use the aws:RequestTag condition key to enforce that specific tags must be present during resource creation. If the tags are missing, the API call (ec2:RunInstances) is denied proactively.

Common mistakes

Confusing Tag Policies (which enforce tag values) with SCPs (which can enforce tag presence).

Question 47 All questions Question 49

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →