DOP-C02 Service Control Policy (SCP) Practice Question
An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?
⚠ Common exam trap
The trap is assuming that any encryption (SSE-S3 or SSE-KMS) satisfies the SCP requirement. However, SCPs can be very specific; if the SCP only allows SSE-S3, then using SSE-KMS will be denied. Candidates may overlook the distinction between encryption types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.
The SCP denies the creation of S3 buckets without encryption, but it specifically allows only SSE-S3 encryption. If the CloudFormation template specifies SSE-KMS encryption, the SCP will deny the request, causing an access denied error—even though encryption is present. This mismatch between the encryption type required by the SCP (SSE-S3) and what the template requests (SSE-KMS) is the most likely cause of the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.
Why this is correct
Correct. SCPs are service control policies that set maximum permissions for all IAM principals in an account, and they can include conditions that deny S3 bucket creation when SSE-KMS is specified. If the organization's SCP only allows SSE-S3 encryption (or denies kms:GenerateDataKey or kms:CreateGrant), then any CloudFormation template that specifies SSE-KMS encryption for the bucket will be rejected with an AccessDenied error, regardless of the IAM service role or the target bucket configuration. This perfectly matches the scenario where the error occurs only when certain encryption settings are present in the template.
- ✗
The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.
Why it's wrong here
Incorrect. Denying s3:PutBucketPublicAccessBlock would produce an error that explicitly indicates a failed PutBucketPublicAccessBlock API call, and it would happen for every bucket creation because CloudFormation always attempts to apply a public access block by default. The error is instead tied to encryption configuration in the template, which implicates the S3 bucket encryption API (PutBucketEncryption) or KMS key permissions, not the public access block action. Furthermore, SCP denials for PutBucketPublicAccessBlock would not be selectively triggered by the presence of SSE-KMS settings.
- ✗
The SCP is incorrectly scoped to the management account instead of the member accounts.
Why it's wrong here
Incorrect. SCPs attached to the management account do not restrict IAM principals in member accounts, because the management account is excluded from the policy effects for member accounts; member accounts are governed only by SCPs attached directly to them or inherited from their organizational units. Since the error occurs in a member account managed by CloudFormation, the SCP must be correctly scoped to that account or its OUs. If the SCP were mis-scoped solely to the management account, the member account would not see any AccessDenied from the SCP, and bucket creation would proceed normally.
- ✗
The CloudFormation service role does not have permissions to create buckets in the target account.
Why it's wrong here
Incorrect. Although an under-scoped CloudFormation service role could certainly cause PutBucket failures, the scenario explicitly states the error persists even when the template includes encryption settings, and the failure is an SCP-driven AccessDenied rather than an IAM permissions issue. SCPs act as an account-level boundary that overrides even a fully privileged IAM role, so the root cause is not a missing service-role permission but a guardrail that denies specific S3 actions. Additionally, the mention of encryption in the template as the trigger directly points to an SCP condition restricting encryption types.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.