SAP-C02 Continuous Improvement for Existing Solutions Practice Question

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.

A service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly. Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS Config rules with auto-remediation using SSM Automation.
Why it's wrong here
This option uses AWS Config rules with SSM Automation to remediate non-compliant buckets after creation, but it is reactive and requires maintaining the SSM Automation document. It is not as effective as prevention.
✗
Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.
Why it's wrong here
This option uses a Lambda function triggered by S3 bucket creation events to enable encryption. It is reactive and may have a delay before encryption is applied, leaving a window of non-compliance. It also requires ongoing maintenance of the Lambda function.
✗
Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.
Why it's wrong here
This option creates a CloudTrail alert for non-encrypted bucket creation but does not automatically remediate; it only notifies. It requires manual intervention to fix the issue.
✓
Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.
Why this is correct
This option uses a service control policy (SCP) to deny the s3:PutBucketEncryption action unless encryption is set. This proactively prevents the creation of non-compliant buckets and requires minimal ongoing maintenance.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question