CLF-C02 Security and Compliance Practice Question
A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?
⚠ Common exam trap
Many candidates confuse account-level default encryption settings (which are per-account and not centrally enforced) with SCPs, which provide organization-wide preventive controls without requiring individual account configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled
An SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (AWS KMS) with automatic key rotation
Why it's wrong here
AWS KMS is a key management service that provides encryption keys and automatic rotation, but it does not enforce that EBS volumes must be encrypted. Even with key rotation enabled, a principal with ec2:CreateVolume permission can still omit the encryption parameter and create an unencrypted volume, because KMS does not intercept or evaluate EC2 API calls. KMS only enables encryption when explicitly used; it offers no preventive control at the point of volume creation.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to ensure that encryption keys used for EBS volumes are automatically rotated for compliance, without needing to enforce encryption at creation time.
- ✓
AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled
Why this is correct
An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.
- ✗
Amazon EBS encryption by default at the account level, configured via the EC2 console in each account
Why it's wrong here
While this setting can be enabled per account to encrypt new volumes by default, it requires individual account administrators to configure it. The question specifies a centrally managed solution that does not rely on per-account actions.
When this WOULD be correct
This option would be correct if the question asked for a solution where each account administrator independently enables encryption by default for their own account, without requiring central enforcement or organization-wide policy.
- ✗
AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation
Why it's wrong here
AWS Config is a detective and reactive service. It can detect unencrypted volumes after they are created and trigger remediation, but it does not proactively prevent the creation. The requirement is to prevent creation in the first place.
When this WOULD be correct
This option would be correct if the requirement were to detect and automatically remediate existing unencrypted EBS volumes (e.g., encrypt them after creation) rather than proactively prevent their creation across all accounts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabledCorrect answer▾
Why this is correct
An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.
✗AWS Key Management Service (AWS KMS) with automatic key rotationWrong answer — click to see why▾
Why this is wrong here
AWS KMS with automatic key rotation manages encryption keys but does not enforce encryption on EBS volumes; it cannot prevent creation of unencrypted volumes.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to ensure that encryption keys used for EBS volumes are automatically rotated for compliance, without needing to enforce encryption at creation time.
Why candidates choose this
Candidates may confuse key management with encryption enforcement, assuming that using KMS automatically encrypts volumes or that key rotation implies encryption is mandatory.
✗Amazon EBS encryption by default at the account level, configured via the EC2 console in each accountWrong answer — click to see why▾
Why this is wrong here
This option requires individual account administrators to enable encryption by default in each account, which does not meet the requirement for a centrally managed solution that proactively prevents unencrypted volumes without per-account action.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution where each account administrator independently enables encryption by default for their own account, without requiring central enforcement or organization-wide policy.
Why candidates choose this
Candidates may confuse account-level encryption defaults with organization-wide enforcement, or assume that enabling it per account is sufficient when the requirement explicitly demands central management.
✗AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediationWrong answer — click to see why▾
Why this is wrong here
AWS Config with a Lambda function is a reactive, not proactive, solution—it detects and remediates unencrypted volumes after creation, whereas the requirement is to proactively prevent creation of unencrypted volumes.
★ When this WOULD be the correct answer
This option would be correct if the requirement were to detect and automatically remediate existing unencrypted EBS volumes (e.g., encrypt them after creation) rather than proactively prevent their creation across all accounts.
Why candidates choose this
Candidates may think AWS Config provides a centralized, automated enforcement mechanism, but they overlook that it is detective/reactive rather than preventive, which is explicitly required in the question.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.