SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies. Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Resource Access Manager
Why it's wrong here
Used to share resources, not enforce security policies.
- ✗
AWS WAF
Why it's wrong here
Web application firewall, not for S3 bucket policies.
- ✗
AWS IAM Identity Center (SSO)
Why it's wrong here
Manages user access, not bucket policies.
- ✓
AWS Config
Why this is correct
Can evaluate bucket policies and auto-remediate non-compliant buckets.
- ✓
AWS Organizations Service Control Policies (SCPs)
Why this is correct
Can deny actions that make buckets public.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?
easy- A.Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.
- B.Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.
- ✓ C.Create a conformance pack in the management account and deploy it to the organization.
- D.Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.
- ✓ E.Enable AWS Config in every account of the organization.
Why C: To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources. Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.