SAA-C03 Design Secure Architectures Practice Question
A order processing API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?
⚠ Common exam trap
Test-takers frequently confuse detective/reactive controls (like Lambda remediation) with preventive controls (like SCPs), leading candidates to choose a solution that fixes the problem after it occurs rather than blocking it entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP that denies ec2:CreateVolume when the encrypted condition is false
Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume API call when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created at the account level, regardless of IAM permissions. SCPs operate at the AWS Organizations root, OU, or account level and are evaluated before any IAM policies, making them the strongest preventive mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a daily Lambda function to encrypt unencrypted volumes
Why it's wrong here
A daily Lambda sweep is detective and remedial, not preventive: unencrypted volumes exist and are usable until the next run. Remediation suits cleaning up legacy volumes after the fact; preventing creation requires an IAM or SCP condition denying ec2:CreateVolume without encryption.
- ✗
Enable VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic metadata for network analysis, not EBS volume creation, so they cannot block an unencrypted volume. They are the right tool for diagnosing connectivity and rejected traffic, not for enforcing encryption at resource-creation time.
- ✓
Use an SCP that denies ec2:CreateVolume when the encrypted condition is false
Why this is correct
An SCP denying `ec2:CreateVolume` when the `ec2:Encrypted` condition key is false blocks unencrypted volume creation across every account in the organisation, regardless of IAM permissions. This preventive guardrail satisfies the requirement that only encrypted EBS volumes can be created, unlike detective controls or default encryption settings.
- ✗
Tag encrypted volumes after creation
Why it's wrong here
Tagging after creation neither prevents nor detects unencrypted volumes; it merely labels what already exists. Tagging suits cost allocation and inventory reporting, whereas the requirement demands a preventive control that blocks unencrypted volume creation outright.
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.