SAA-C03 Design Secure Architectures Practice Question
A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?
⚠ Common exam trap
SAA-C03 often tests the misconception that IAM policies or bucket policies can enforce organization-wide region restrictions, when only SCPs provide centralized preventive control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.
A Service Control Policy (SCP) attached to the organization root applies to all member accounts and can deny s3:CreateBucket when the requested region is not us-east-1 or us-west-2. SCPs are the centralized, efficient way to enforce guardrails across an AWS Organization, affecting all principals without per-account changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply an IAM policy to every developer user in each account that denies s3:CreateBucket in restricted regions.
Why it's wrong here
IAM policies attached to users only restrict those specific identities within a single account. They cannot override permissions granted to other users or the root user, nor can they enforce a consistent security posture across multiple accounts in an AWS Organization effectively without significant management overhead and risk.
- ✗
Configure an S3 bucket policy on all existing buckets to prevent the creation of new buckets in other regions.
Why it's wrong here
Resource-based policies, such as S3 bucket policies, are specific to individual resources and do not provide a mechanism for broad service restrictions across an account. While they can deny access to a specific bucket, they cannot prevent a user from creating new resources in unauthorized AWS regions.
- ✓
Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.
Why this is correct
Service Control Policies allow the organization's management account to set the maximum available permissions for member accounts. A Deny rule in an SCP acts as a guardrail that overrides any local IAM permissions, ensuring that restricted services or regions remain inaccessible regardless of local configurations within the accounts.
- ✗
Enable AWS Config in all accounts and create a custom rule to delete any bucket created in a restricted region.
Why it's wrong here
AWS Config rules are used to monitor and evaluate the configuration of your AWS resources for compliance. While they can trigger automated remediation via Lambda or Systems Manager, they do not prevent the initial creation of resources, making them a detective control rather than a preventative security measure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.