DOP-C02 Security and Compliance Practice Question
A company uses AWS Organizations with multiple accounts. The security team requires that all newly created S3 buckets in any account automatically have default encryption enabled and block public access. Which solution is MOST operationally efficient?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) that denies creation of buckets without encryption and public access block
The most operationally efficient solution is to use an SCP in AWS Organizations that denies creation of S3 buckets without default encryption and public access block. This enforces the security requirements at the organization level, preventing non-compliant bucket creation across all accounts without additional automation. Option A relies on CloudTrail and Lambda, which is reactive and adds complexity. Option C is manual and not scalable. Option D uses AWS Config to detect non-compliant buckets but requires additional remediation steps, making it less efficient than a preventive SCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to apply settings
Why it's wrong here
This approach is reactive and not preventive: CloudTrail publishes a bucket-creation event only after the bucket exists in any account, and the Lambda function then applies encryption/block settings post-hoc. During the interval between creation and remediation, the bucket is non-compliant and may be publicly accessible or unencrypted. It also requires per-account or centrally orchestrated cross-account event delivery, custom IAM roles, and error handling for failed invocations, making it brittle compared to an organization-wide guardrail.
- ✓
Apply a service control policy (SCP) that denies creation of buckets without encryption and public access block
Why this is correct
An SCP is a preventive, organization-wide control enforced by AWS Organizations before the action is authorized; it cannot be overridden by any IAM policy within the account. To deny non-compliant creation, you attach to the root/OU a policy that denies s3:CreateBucket with a StringNotEquals condition on s3:x-amz-server-side-encryption and a StringNotEquals condition on s3:x-amz-public-access-block, so only requests meeting both criteria succeed. This approach automatically covers every existing and future account and bucket without custom code or manual catch-up.
- ✗
Create a bucket policy on each existing bucket and rely on developers to apply it to new buckets
Why it's wrong here
Bucket policies are resource-based and apply only to the specific bucket they are attached to; they cannot affect the creation of future buckets or be applied to a bucket that does not yet exist. Relying on developers to manually attach these policies is error-prone and provides no enforcement when a developer forgets, leaving new buckets unencrypted or publicly accessible. Additionally, bucket policies cannot themselves require that a bucket be created with SSE enabled or a public access block attached — they govern access to the bucket, not its configuration at creation time.
- ✗
Use AWS Config rules to detect non-compliant buckets and send notifications
Why it's wrong here
AWS Config rules are detective controls that continuously evaluate existing resources and can flag non-compliant buckets, delivering SNS notifications when a rule is non-compliant. However, they act after the resource is created and do not block the CreateBucket API call, so the bucket remains non-compliant until manually remediated or an automated action is triggered. The detection-to-remediation cycle introduces latency and relies on additional automation, whereas a preventive SCP stops the non-compliant action outright.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.