- A
AWS Key Management Service (AWS KMS) with automatic key rotation
Why wrong: AWS KMS provides the encryption keys and automatic rotation, but it does not enforce that EBS volumes must be encrypted. KMS is a key management service, not a policy enforcement tool.
- B
AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled
An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.
- C
Amazon EBS encryption by default at the account level, configured via the EC2 console in each account
Why wrong: While this setting can be enabled per account to encrypt new volumes by default, it requires individual account administrators to configure it. The question specifies a centrally managed solution that does not rely on per-account actions.
- D
AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation
Why wrong: AWS Config is a detective and reactive service. It can detect unencrypted volumes after they are created and trigger remediation, but it does not proactively prevent the creation. The requirement is to prevent creation in the first place.
CLF-C02 Security and Compliance Practice Question
This CLF-C02 practice question tests your understanding of security and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: sCPs define maximum permissions for accounts in an AWS Organization.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to enforce that all Amazon Elastic Block Store (EBS) volumes created in any account within the organization are automatically encrypted at rest. The team needs a centrally managed solution that proactively prevents the creation of unencrypted EBS volumes without requiring individual account administrators to enable any settings. Which AWS feature should the security team use to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled
Option B is correct because an SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.
Key principle: SCPs define maximum permissions for accounts in an AWS Organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (AWS KMS) with automatic key rotation
Why it's wrong here
AWS KMS provides the encryption keys and automatic rotation, but it does not enforce that EBS volumes must be encrypted. KMS is a key management service, not a policy enforcement tool.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to ensure that encryption keys used for EBS volumes are automatically rotated for compliance, without needing to enforce encryption at creation time.
- ✓
AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled
Why this is correct
An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.
Related concept
SCPs define maximum permissions for accounts in an AWS Organization.
- ✗
Amazon EBS encryption by default at the account level, configured via the EC2 console in each account
Why it's wrong here
While this setting can be enabled per account to encrypt new volumes by default, it requires individual account administrators to configure it. The question specifies a centrally managed solution that does not rely on per-account actions.
When this WOULD be correct
This option would be correct if the question asked for a solution where each account administrator independently enables encryption by default for their own account, without requiring central enforcement or organization-wide policy.
- ✗
AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediation
Why it's wrong here
AWS Config is a detective and reactive service. It can detect unencrypted volumes after they are created and trigger remediation, but it does not proactively prevent the creation. The requirement is to prevent creation in the first place.
When this WOULD be correct
This option would be correct if the requirement were to detect and automatically remediate existing unencrypted EBS volumes (e.g., encrypt them after creation) rather than proactively prevent their creation across all accounts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabledCorrect answer▾
Why this is correct
An SCP can be applied to the root or specific organizational units (OUs) to deny the creation of unencrypted EBS volumes. This centrally enforces the encryption requirement across all affected accounts without requiring any local configuration. It is a proactive, preventive control.
✗AWS Key Management Service (AWS KMS) with automatic key rotationWrong answer — click to see why▾
Why this is wrong here
AWS KMS with automatic key rotation manages encryption keys but does not enforce encryption on EBS volumes; it cannot prevent creation of unencrypted volumes.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to ensure that encryption keys used for EBS volumes are automatically rotated for compliance, without needing to enforce encryption at creation time.
Why candidates choose this
Candidates may confuse key management with encryption enforcement, assuming that using KMS automatically encrypts volumes or that key rotation implies encryption is mandatory.
✗Amazon EBS encryption by default at the account level, configured via the EC2 console in each accountWrong answer — click to see why▾
Why this is wrong here
This option requires individual account administrators to enable encryption by default in each account, which does not meet the requirement for a centrally managed solution that proactively prevents unencrypted volumes without per-account action.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution where each account administrator independently enables encryption by default for their own account, without requiring central enforcement or organization-wide policy.
Why candidates choose this
Candidates may confuse account-level encryption defaults with organization-wide enforcement, or assume that enabling it per account is sufficient when the requirement explicitly demands central management.
✗AWS Config with a managed rule to detect unencrypted volumes and trigger an AWS Lambda function for automatic remediationWrong answer — click to see why▾
Why this is wrong here
AWS Config with a Lambda function is a reactive, not proactive, solution—it detects and remediates unencrypted volumes after creation, whereas the requirement is to proactively prevent creation of unencrypted volumes.
★ When this WOULD be the correct answer
This option would be correct if the requirement were to detect and automatically remediate existing unencrypted EBS volumes (e.g., encrypt them after creation) rather than proactively prevent their creation across all accounts.
Why candidates choose this
Candidates may think AWS Config provides a centralized, automated enforcement mechanism, but they overlook that it is detective/reactive rather than preventive, which is explicitly required in the question.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse account-level default encryption settings (which are per-account and not centrally enforced) with SCPs, which provide organization-wide preventive controls without requiring individual account configuration.
Detailed technical explanation
How to think about this question
SCPs are evaluated before any IAM policies in member accounts, so a deny on CreateVolume with a condition for ec2:Encrypted = false effectively blocks the API call at the organization level. The SCP uses the ec2:Encrypted condition key, which must be explicitly set to true in the API request; if the parameter is omitted, the condition fails and the action is denied. This ensures that even if an account has its own permissive IAM policies, the SCP overrides them for unencrypted volume creation.
KKey Concepts to Remember
- SCPs define maximum permissions for accounts in an AWS Organization.
- SCPs are preventive controls, blocking actions before they occur.
- SCPs use IAM policy syntax to specify allowed or denied actions and conditions.
- SCPs can be applied to the root, OUs, or individual accounts within an organization.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
SCPs define maximum permissions for accounts in an AWS Organization.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review sCPs define maximum permissions for accounts in an AWS Organization., then practise related CLF-C02 questions on the same topic to reinforce the concept.
- →
Security and Compliance — study guide chapter
Learn the concepts, then practise the questions
- →
Security and Compliance practice questions
Targeted practice on this topic area only
- →
All CLF-C02 questions
1,024 questions across all exam domains
- →
AWS Certified Cloud Practitioner CLF-C02 study guide
Full concept coverage aligned to exam objectives
- →
CLF-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CLF-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Cloud Concepts practice questions
Practise CLF-C02 questions linked to Cloud Concepts.
Security and Compliance practice questions
Practise CLF-C02 questions linked to Security and Compliance.
Cloud Technology and Services practice questions
Practise CLF-C02 questions linked to Cloud Technology and Services.
Billing, Pricing, and Support practice questions
Practise CLF-C02 questions linked to Billing, Pricing, and Support.
AWS shared responsibility model practice questions
Practise CLF-C02 questions linked to AWS shared responsibility model.
AWS IAM practice questions
Practise CLF-C02 questions linked to AWS IAM.
AWS pricing practice questions
Practise CLF-C02 questions linked to AWS pricing.
AWS support plans practice questions
Practise CLF-C02 questions linked to AWS support plans.
AWS S3 practice questions
Practise CLF-C02 questions linked to AWS S3.
AWS EC2 practice questions
Practise CLF-C02 questions linked to AWS EC2.
Practice this exam
Start a free CLF-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CLF-C02 question test?
Security and Compliance — This question tests Security and Compliance — SCPs define maximum permissions for accounts in an AWS Organization..
What is the correct answer to this question?
The correct answer is: AWS Organizations with a service control policy (SCP) that denies the CreateVolume action unless encryption is enabled — Option B is correct because an SCP in AWS Organizations can centrally deny the ec2:CreateVolume API call unless the request includes a condition that encryption is enabled (e.g., ec2:Encrypted = true). This proactively prevents any user or role in any member account from creating an unencrypted EBS volume, regardless of individual account settings, meeting the requirement for a centrally managed, preventive control.
What should I do if I get this CLF-C02 question wrong?
Review sCPs define maximum permissions for accounts in an AWS Organization., then practise related CLF-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
SCPs define maximum permissions for accounts in an AWS Organization.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More CLF-C02 practice questions
- A company publishes a message each time a new product is added to its catalogue. Three services need to receive this mes…
- A media company stores frequently accessed video thumbnails in Amazon S3. The thumbnails are read multiple times every d…
- A company needs a service to translate domain names (like www.example.com) into IP addresses, check the health of their…
- A startup runs an application on AWS and receives a monthly bill that charges exactly for the number of compute hours us…
- A financial institution runs its core banking application on-premises due to regulatory requirements. It has connected i…
- A company wants to run a MySQL database in AWS without managing database software installation, applying patches, settin…
Last reviewed: Jun 11, 2026
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.