Using AWS Control Tower, a company has an OU that contains multiple AWS accounts. The company must ensure that no new or existing Amazon EC2 instances in those accounts can obtain a public IP address. Which solution enforces this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a Service Control Policy (SCP) that blocks launching instances with a public IP address and also blocks attaching a public IP address to existing instances. Attach the SCP to the OU..
Why this is the answer
The correct answer is to create a Service Control Policy (SCP) because SCPs are a core feature of AWS Organizations (which Control Tower uses) that allow you to centrally manage permissions across multiple accounts. An SCP can explicitly deny actions like ec2:RunInstances if AssociatePublicIpAddress is true, and ec2:AssociateAddress if a public IP is being assigned, effectively preventing public IPs at the organizational level. AWS Systems Manager Automation runbooks are for operational tasks and remediation, not for preventative policy enforcement across an OU. AWS Control Tower proactive controls are for detecting non-compliance before resources are provisioned, but they don't directly block the API calls like an SCP can. AWS Config custom rules are for detecting non-compliance after resources are provisioned and triggering remediation, not for preventing the initial creation or modification.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed