Q94 — AWS SAA-C03 Ch.10

Question 94 of 100 | ← Chapter 10

Q694. A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag.Which combination of steps will meet these requirements? (Select TWO.)

• A. In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU
• B. In Organizations, create a new service control policy(SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU ✓
• C. Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU
• D. Create a service control policy(SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU ✓
• E. Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found

Correct Answer: B. In Organizations, create a new service control policy(SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU, D. Create a service control policy(SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU

Explanation

To meet the requirements of the company designing a new mobile app on AWS Cloud, where EC2 instances need to be tagged with data sensitivity values of sensitive and nonsensitive, and IAM identities must not be able to delete tags or create instances without a tag, the correct combination of steps are:B. In Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OUThis step is important because SCPs allow you to centrally manage permissions across multiple AWS accounts within an organization. By creating an SCP that enforces the use of a specific tag key and values for EC2 instances, you can ensure that all instances launched in the specified OU will be required to have the correct tagging.D. Create a service control policy (SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OUThis step complements the first one by enforcing two critical aspects:Preventing the creation of EC2 instances without the required tag key. This ensures that all new instances will be tagged with the data sensitivity tag.Preventing IAM identities from deleting tags on EC2 instances. This protects the integrity of the tagging scheme by ensuring that tags cannot be removed accidentally or maliciously.The other options do not directly meet the requirements:A and C refer to tag policies, but AWS Organizations does not have a direct concept of "tag policies" for enforcing tagging requirements on resources. Tagging policies are typically enforced through AWS Config rules or through IAM policies combined with SCPs.E suggests using AWS Config and AWS Lambda to delete noncompliant resources. While this could be a solution for enforcing tagging compliance, it's a more complex and potentially disruptive approach compared to using SCPs to prevent noncompliant actions from happening in the first place. Moreover, deleting resources automatically based on noncompliance may not be the desired behavior, especially if there's a chance for false positives or if there's a need for manual review before taking such drastic actions.