SAP-C02 Question 292

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A7

  The key to the answer is in the first sentence of A and B. You can create a Tag Policy in the Management Account not OU since the OU is not an "Account" but a target where a policy is applied. Tag Policy is not the same as an SCP. See: https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/

• 1

  Ok this is strange if you do not use this stuff regularly as AWS uses "tag policy" for several different configuration services. You can apply a tag policy on the management account through AWS Organization. If you do it all child OUs will inherit the tag policy. If you do the same "tag policy" on the management account using AWS Resource Groups Tag Editor it will not be inherited. B was a very seductive answer, even chatGPT made a mistake here by defining this answer as good in first occurence. But considering we use AWS Organization to manage everything, it's clearly an AWS Organization Tag Policy which is used here. So a tag policy applied on the management account will be inherited by the child OUs. Answer is A. AWS terminology can be really bad.

• 1

  Correct A.