Exam AWS Certified Solutions Architect - Professional topic 1 question 1007 discussion

Create Config rule to find resources in all accounts. Aggregate those cross-account findings with Config aggregator so you can see it in one place. Deny ec2:RunInstances with SCP.

ABE is the right answer in my opinion. However, I believe this question is missing an option to fix the existing instances, which is one of the requirements here. Also, we don't need both option A and E. Only the method in option E is enough.

While, there is no confusion that B&E must be selected for this question. The decision to choose between option A & F can easily be taken by understanding the fact that option F (security hub) is easy to configure. Option A requires more effort. They didn't ask for the option with least effort but assume in these exam situation that they would always ask for options which are easy to implement, has less operational overhead, secure and cost efficient. So, B, E and F are the correct options. Check this documentation for more details about Security Hub capability to find missing tags - https://docs.aws.amazon.com/securityhub/latest/userguide/standards-tagging.html

ABE is the correct answer

Correct ABE

ABE seems most likely

Its ABE with the same explanation

BEF ,There are two ask in the question : 1)Find out the list of EC2 instances which are missing tags (Option E and F) 2)Make sure this doesn't happen in the future (Since this is applicable for all the accounts under an organization so SCP seems to be a better option )

B for SCP E & F. config aggregator and display/action using security hub

Correct BDE