Tip: AWS Organziaton + service control policy (SCP) - This for any questions, you see both together. then you tell me C. Create a service control policy (SCP) to prevent tag modification except by authorized principals.

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html AWS example for this question/use case: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html#example-require-restrict-tag-mods-to-admin

D "Amazon CloudWatch" just for logging, not for prevent tag modification https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-cwe.html Amazon Organziaton has "Service Control Policy (SCP)" with "tag policy" https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html . Choose C. AWS Config for technical stuff, not for tag policies. Not A.

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization.

Anytime we need to restrict anything in an AWS Organization, it is SCP Policies.

AWS Config is for tracking configuration changes

I'd say C.

https://docs.aws.amazon.com/ja_jp/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html

Denies tag: modify