Amazon
SAP-C02 · Question #675
A company is using AWS Control Tower to manage AWS accounts in an organization in AWS Organizations. The company has an OU that contains accounts. The company must prevent any new or existing Amazon…
The correct answer is C. Create an SCP that prevents the launch of instances that have a public IP address. Additionally. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-
Submitted by tom_us· Mar 6, 2026Design Solutions for Organizational Complexity
Question
A company is using AWS Control Tower to manage AWS accounts in an organization in AWS Organizations. The company has an OU that contains accounts. The company must prevent any new or existing Amazon EC2 instances in the OU's accounts from gaining a public IP address. Which solution will meet these requirements?
Options
- AConfigure all instances in each account in the OU to use AWS Systems Manager. Use a Systems
- BImplement the AWS Control Tower proactive control to check whether instances in the OU's
- CCreate an SCP that prevents the launch of instances that have a public IP address. Additionally,
- DCreate an AWS Config custom rule that detects instances that have a public IP address.
How the community answered
(25 responses)- A12% (3)
- B4% (1)
- C64% (16)
- D20% (5)
Explanation
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-
Community Discussion
No community discussion yet for this question.