A company is designing a new mobile app architecture in the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage accounts. The company wants EC2 instances to be tagged with data sensitivity using values of sensitive and nonsensitive. IAM identities must not be able to delete the tag or create instances without a tag. Which combination of steps will meet these requirements? (Choose two.)

Tag policies enforce tagging standards across accounts in an organization. Creating a tag policy that specifies the data sensitivity tag key and its required values (sensitive, nonsensitive) ensures that new or updated EC2 instances comply with these predefined values. Attaching this policy to the relevant OU enforces it on all accounts within that OU. Service Control Policies (SCPs) are used to set maximum permissions for accounts in an organization. An SCP can deny the ec2:RunInstances action if the data sensitivity tag is not present, preventing the creation of untagged instances. Another SCP can deny the ec2:DeleteTags action for the data sensitivity tag, preventing its removal. Attaching these SCPs to the OU enforces these restrictions at the organizational level. AWS Config rules can detect non-compliant resources but cannot prevent their creation or tag deletion, making them reactive rather than preventive.