ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all new S3 buckets created across accounts have encryption enabled and block public access. Which TWO approaches meet these requirements? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.
SCPs can be applied to the root OU to deny s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption unless the bucket meets encryption and public access requirements, thus enforcing the policy organization-wide. Option C is correct because AWS Config conformance packs can include managed rules to detect buckets without encryption or with public access, and automatic remediation actions can be configured to fix non-compliant buckets. Option B is incorrect because an S3 bucket policy only applies to a single bucket and cannot enforce requirements across all buckets in all accounts; it also cannot prevent creation of buckets that don't meet the policy. Option D is incorrect because CloudTrail only provides logging and alerting; it does not enforce or remediate. Option E is incorrect because an IAM role with MFA requirement does not enforce encryption or public access settings on buckets; it only controls who can create buckets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the configuration does not meet requirements.
Why this is correct
Correct: SCPs can deny non-compliant actions across accounts.
- ✗
Use an S3 bucket policy that denies all principals unless encryption is enabled.
Why it's wrong here
Wrong: Bucket policies are per-bucket and not organization-wide.
- ✓
Create an AWS Config conformance pack with rules that check for encryption and public access, and auto-remediate non-compliant buckets.
Why this is correct
Correct: Config rules can detect and remediate non-compliance.
- ✗
Enable AWS CloudTrail to monitor bucket creation and send alerts to the security team.
Why it's wrong here
Wrong: CloudTrail only logs, not enforce.
- ✗
Create an IAM role in each account that requires MFA for creating S3 buckets.
Why it's wrong here
Wrong: Does not enforce encryption or public access settings.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?
hard- A.Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.
- B.Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.
- ✓ C.Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.
- D.Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.
Why C: AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement. Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.
Variation 2. A company has a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets are encrypted with SSE-KMS using a specific KMS key. Which policy should they use?
hard- A.S3 bucket policy on each bucket
- B.IAM policy in each account
- C.AWS Config rule with auto-remediation
- ✓ D.SCP in AWS Organizations
Why D: A Service Control Policy (SCP) in AWS Organizations can be attached to the root or an OU to deny the creation of S3 buckets that do not use a specific KMS key for encryption. This is a preventive control that applies across all accounts in the organization. Option A (S3 bucket policy) is incorrect because bucket policies are applied at the bucket level after creation and cannot prevent the creation of the bucket. Option B (IAM policy) is incorrect because IAM policies are per-account and cannot be enforced centrally across all accounts. Option C (AWS Config rule with auto-remediation) is incorrect because Config rules are detective and can only trigger remediation after a non-compliant bucket is created, not prevent the creation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.