DOP-C02 AWS CloudFormation StackSets Practice Question
A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?
⚠ Common exam trap
The trap is that candidates may believe an SCP can be used to enforce a Config rule, but SCPs only deny or allow actions; they don't deploy configurations. The correct approach uses StackSets or organization-level Config rules for automatic deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.
AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.
Why it's wrong here
An SCP can deny the creation of unencrypted EBS volumes by using the ec2:Encrypted condition key, but it only affects new API calls and does nothing to remediate volumes that already exist. The additional use of AWS Config to detect noncompliant volumes is passive reporting; detection alone does not trigger remediation or deploy any rule stack. This combination lacks a deployment mechanism and a remediation action, so it fails the requirement to ensure the Config rule is actively applied across the organization.
- ✗
Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.
Why it's wrong here
While an SCP can deny the ability to disable a specific AWS Config rule, the SCP does not create or deploy that rule; it can only prevent interference with a rule that already exists. The custom Config rule itself still needs to be deployed to each account, which this solution does not specify, and there is no automatic onboarding for newly created accounts. Additionally, relying on a custom rule for EBS encryption evaluation requires a Lambda function and permissions that also must be centrally deployed, leaving the core problem of rule propagation unsolved.
- ✗
Use an AWS Config aggregator in the management account to monitor compliance across accounts.
Why it's wrong here
An AWS Config aggregator centralizes compliance and resource data from multiple accounts and regions into a single view, but it does not deploy, modify, or manage AWS Config rules. Without a rule already present in each account, the aggregator has nothing to aggregate, and new accounts are not automatically added to the aggregator. This solution addresses monitoring visibility only, not rule deployment.
- ✓
Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.
Why this is correct
AWS CloudFormation StackSets let you define a stack containing the AWS Config rule once and deploy it to specified accounts across the organization. With service-managed StackSets, you can enable automatic deployment so that any new account added to the organization is automatically provisioned with the stack, ensuring the Config rule exists in every account. This centrally manages the rule's lifecycle and avoids needing per-account manual setup, making it the appropriate solution.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.