SAP-C02 Question 111

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  The correct answer is C. Using IAM policies, you can control which EC2 instance types specific users (like developers) are allowed to launch. This is the only option that proactively prevents launching unapproved instance types. AWS Config (A) only detects after the fact, Launch Templates (B) are not enforceable, and Image Builder (D) doesn’t control instance size. IAM policies offer a scalable and enforceable solution that aligns with the Well-Architected Framework’s Cost Optimization pillar.

• 1

  C. Create a new IAM policy. Specify the instance types that are allowed. Attach the policy to an IAM group that contains the IAM accounts for the developers

• Chose C7

  { "Sid": "limitedSize", "Effect": "Deny", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "ForAnyValue:StringNotLike": { "ec2:InstanceType": [ "*.nano", "*.small", "*.micro", "*.medium" ] } } }