DVA-C02 Security Practice Question
A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?
⚠ Common exam trap
Candidates often confuse IAM policies (which are account-scoped) with SCPs (which are organization-wide), and assume that AWS Config remediation or CloudTrail can proactively enforce encryption, when in fact only SCPs can deny the API call at the point of creation across all accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.
A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.
Why it's wrong here
An IAM policy is scoped to a specific AWS account and applies only to identities or resources within that account. Creating an IAM policy in a central security account would not automatically extend its enforcement to S3 buckets or actions performed in other member accounts of the AWS Organization. To enforce a consistent security baseline across multiple accounts, a higher-level, organization-wide mechanism is required.
- ✗
Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.
Why it's wrong here
AWS Config is a compliance auditing service that detects and reports on resource configurations *after* they have been created or modified. While it can trigger remediation actions to apply default encryption, it does not proactively prevent the initial creation of non-compliant S3 buckets or objects. Furthermore, even with default encryption, users could potentially upload objects without SSE-KMS or modify bucket encryption settings later, making it a reactive and potentially bypassable solution.
- ✗
Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.
Why it's wrong here
AWS CloudTrail provides a comprehensive log of API calls and events made within an AWS account, including S3 actions. However, CloudTrail is purely an auditing and logging service; it does not possess any enforcement capabilities to prevent actions from occurring. Relying on manual review of CloudTrail logs is a reactive and labor-intensive process that would not prevent non-compliant S3 buckets or objects from being created in real-time across a multi-account environment.
- ✓
Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.
Why this is correct
Service Control Policies (SCPs) are a feature of AWS Organizations that allow central management of permissions across all accounts in the organization. An SCP can explicitly deny actions like `s3:PutObject` and `s3:PutBucketEncryption` unless specific conditions, such as the use of SSE-KMS with a designated KMS key, are met. This provides proactive, preventative enforcement at the organizational level, ensuring compliance before resources are created or modified.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.