- A
Create an SCP that denies s3:PutObject unless encryption headers are included.
Why wrong: SCPs cannot enforce encryption at the bucket level; they can deny actions based on conditions, but this only affects object uploads, not bucket encryption settings.
- B
Create an SCP that requires all objects to be uploaded with server-side encryption.
Why wrong: This does not enforce bucket-level default encryption; objects can still be uploaded without encryption if the bucket policy allows it.
- C
Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.
While this does not directly enforce encryption, it is a common security baseline, and combined with Config can ensure encryption. However, the correct answer is that S3 default encryption can be enforced via Config and SCPs can prevent disabling of block public access.
- D
Create an SCP that denies the s3:CreateBucket action to all accounts.
Why wrong: This prevents new buckets but does not enforce encryption on existing buckets.
- E
Use AWS Config rules to detect buckets without default encryption and auto-remediate with a Lambda function.
Config rules can trigger remediation to enable default encryption on non-compliant buckets.
Quick Answer
The correct answer is to use AWS Config rules to detect S3 buckets without default encryption and auto-remediate with a Lambda function, combined with an SCP that denies disabling S3 Block Public Access at the account level. This works because AWS Config continuously evaluates your S3 buckets against the encryption rule, and the Lambda function automatically enables default encryption on any non-compliant bucket, while the SCP prevents any account from turning off the Block Public Access setting, ensuring that all buckets remain private and encryption cannot be bypassed. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your ability to enforce S3 bucket encryption across all AWS accounts using a detective and preventive control pair—a common pattern for organization-wide compliance. A frequent trap is choosing only one control, such as a single AWS Config rule without auto-remediation, or forgetting that SCPs can block disabling of security settings. Memory tip: think “Detect and Prevent”—Config detects, SCP prevents.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.
Option C is correct because enabling S3 Block Public Access at the account level prevents any public access to S3 buckets, and using a service control policy (SCP) to deny actions that would disable this setting ensures it cannot be overridden by any account in the organization. This enforces encryption indirectly by ensuring that all buckets are private, but the primary requirement is encryption; however, the question asks for two actions, and C combined with E provides a complete solution. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable encryption, ensuring compliance across all accounts.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an SCP that denies s3:PutObject unless encryption headers are included.
Why it's wrong here
SCPs cannot enforce encryption at the bucket level; they can deny actions based on conditions, but this only affects object uploads, not bucket encryption settings.
- ✗
Create an SCP that requires all objects to be uploaded with server-side encryption.
Why it's wrong here
This does not enforce bucket-level default encryption; objects can still be uploaded without encryption if the bucket policy allows it.
- ✓
Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.
Why this is correct
While this does not directly enforce encryption, it is a common security baseline, and combined with Config can ensure encryption. However, the correct answer is that S3 default encryption can be enforced via Config and SCPs can prevent disabling of block public access.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Create an SCP that denies the s3:CreateBucket action to all accounts.
Why it's wrong here
This prevents new buckets but does not enforce encryption on existing buckets.
- ✓
Use AWS Config rules to detect buckets without default encryption and auto-remediate with a Lambda function.
Why this is correct
Config rules can trigger remediation to enable default encryption on non-compliant buckets.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think SCPs can enforce encryption on object uploads (Option B), but SCPs only control API permissions, not the actual content of API requests, so they cannot require encryption headers—only bucket policies or AWS Config rules can enforce that.
Detailed technical explanation
How to think about this question
S3 Block Public Access settings at the account level override any bucket-level public access settings, and an SCP can deny the s3:PutBucketPublicAccessBlock action to prevent disabling these settings. AWS Config managed rule 's3-bucket-server-side-encryption-enabled' can evaluate buckets for default encryption, and a custom Lambda function can use the PutBucketEncryption API to enable AES-256 or AWS-KMS encryption. In a multi-account environment, combining preventive controls (SCPs) with detective/remediative controls (AWS Config + Lambda) is a defense-in-depth strategy.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Design Solutions for Organizational Complexity — study guide chapter
Learn the concepts, then practise the questions
- →
Design Solutions for Organizational Complexity practice questions
Targeted practice on this topic area only
- →
All SAP-C02 questions
1,746 questions across all exam domains
- →
AWS Certified Solutions Architect Professional SAP-C02 study guide
Full concept coverage aligned to exam objectives
- →
SAP-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SAP-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Design Solutions for Organizational Complexity practice questions
Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.
Design for New Solutions practice questions
Practise SAP-C02 questions linked to Design for New Solutions.
Continuous Improvement for Existing Solutions practice questions
Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.
Accelerate Workload Migration and Modernization practice questions
Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.
SAA-C03 VPC practice questions
Practise SAP-C02 questions linked to SAA-C03 VPC.
SAA-C03 S3 lifecycle policy questions
Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.
SAA-C03 RDS Multi-AZ questions
Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.
SAA-C03 IAM policy practice questions
Practise SAP-C02 questions linked to SAA-C03 IAM policy.
SAA-C03 Route 53 failover questions
Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.
SAA-C03 CloudFront practice questions
Practise SAP-C02 questions linked to SAA-C03 CloudFront.
SAA-C03 NAT gateway questions
Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.
SAA-C03 VPC endpoint questions
Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.
Practice this exam
Start a free SAP-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SAP-C02 question test?
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it. — Option C is correct because enabling S3 Block Public Access at the account level prevents any public access to S3 buckets, and using a service control policy (SCP) to deny actions that would disable this setting ensures it cannot be overridden by any account in the organization. This enforces encryption indirectly by ensuring that all buckets are private, but the primary requirement is encryption; however, the question asks for two actions, and C combined with E provides a complete solution. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable encryption, ensuring compliance across all accounts.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?
hard- A.Use AWS CloudTrail to monitor for public bucket creation and alert the security team.
- B.Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.
- C.Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.
- ✓ D.Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.
Why D: Option D is correct because S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.
Last reviewed: Jun 24, 2026
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.