SAP-C02 Q410 · Multi-Account

Question

A company is using AWS Control Tower to manage AWS accounts in an organization in AWS Organizations. The company has an OU that contains accounts. The company must prevent any new or existing Amazon EC2 instances in the OUs accounts from gaining a public IP address. Which solution will meet these requirements?

Accepted Answer

**Option C: SCP attached to the OU** is the correct answer because it satisfies every requirement:

1. **Prevention (not detection):** The question explicitly says "must prevent" — SCPs are **preventive controls** that deny API calls before they execute. An SCP can deny `ec2:RunInstances` when the condition checks for public IP association, and deny `ec2:AssociateAddress` to prevent attaching Elastic IPs to existing instances.

2. **Covers new AND existing instances:** The SCP can include two deny statements:
   - Deny `ec2:RunInstances` with a condition like `"ec2:AssociatePublicIpAddress": "true"` to block launching instances with public IPs
   - Deny `ec2:AssociateAddress` to prevent attaching public/Elastic IPs to existing instances

3. **OU-wide enforcement:** SCPs are natively design

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips