DOP-C02 Service Control Policy (SCP) Practice Question
A company manages multiple AWS accounts using AWS Organizations. The DevOps team needs to enforce that all newly created S3 buckets in any account automatically have versioning enabled and are encrypted with SSE-S3. Which THREE steps should the team take to achieve this using Infrastructure as Code and policy-based controls?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies s3:PutObject if the bucket does not have encryption enabled.
To enforce S3 bucket versioning and encryption using IaC and policy controls, three steps are effective. Option A: Create an SCP that denies s3:PutObject if encryption is not enabled, preventing non-compliant bucket creation. Option D: Use AWS CloudFormation StackSets to deploy a baseline template across all accounts that creates S3 buckets with versioning and SSE-S3 encryption. Option E: Deploy an AWS Config managed rule to check for versioning and use automatic remediation via SSM Automation to enable versioning on non-compliant buckets. Option B (CodePipeline) does not enforce policies proactively, and Option C (manual) is not scalable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an SCP that denies s3:PutObject if the bucket does not have encryption enabled.
Why this is correct
SCPs can restrict API calls across accounts, enforcing encryption at creation time.
- ✗
Configure AWS CodePipeline to run a script that checks bucket configurations after creation.
Why it's wrong here
CodePipeline is for CI/CD pipelines, not for proactive enforcement.
- ✗
Manually configure each new bucket via the AWS Management Console.
Why it's wrong here
Manual configuration is error-prone and does not scale.
- ✓
Use AWS CloudFormation StackSets to deploy a template that creates S3 buckets with required settings in all accounts.
Why this is correct
StackSets enable consistent resource deployment across multiple accounts.
- ✓
Deploy an AWS Config managed rule to check that S3 buckets have versioning enabled, with automatic remediation using SSM Automation.
Why this is correct
Config rules detect non-compliance and can trigger remediation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,487 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.