SAA-C03 Design Secure Architectures Practice Question
A order processing API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?
⚠ Common exam trap
Test-takers frequently confuse detective/reactive controls (like Lambda remediation) with preventive controls (like SCPs), leading candidates to choose a solution that fixes the problem after it occurs rather than blocking it entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an SCP that denies ec2:CreateVolume when the encrypted condition is false
Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume API call when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created at the account level, regardless of IAM permissions. SCPs operate at the AWS Organizations root, OU, or account level and are evaluated before any IAM policies, making them the strongest preventive mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a daily Lambda function to encrypt unencrypted volumes
Why it's wrong here
Reactive remediation leaves a window of exposure.
- ✗
Enable VPC Flow Logs
Why it's wrong here
Flow Logs monitor network traffic and do not control EBS encryption.
- ✓
Use an SCP that denies ec2:CreateVolume when the encrypted condition is false
Why this is correct
An SCP can prevent noncompliant volume creation across accounts in an organization.
- ✗
Tag encrypted volumes after creation
Why it's wrong here
Tags identify resources but do not enforce encryption.
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.