SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently confuse detective controls (like AWS Config rules) with preventive controls (like SCPs or CloudFormation Guard), leading them to select Option D even though it only reports non-compliance after the fact, not preventing the creation of unencrypted buckets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS CloudFormation Guard to validate templates before deployment.
AWS CloudFormation Guard (cfn-guard) allows you to define rules that validate CloudFormation templates before deployment. You can create a rule that checks whether the `BucketEncryption` property is set on every `AWS::S3::Bucket` resource, preventing the creation of unencrypted buckets at the template level. This enforces encryption as a policy-as-code gate in the CI/CD pipeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an IAM permissions boundary for all IAM roles.
Why it's wrong here
Permissions boundaries do not enforce encryption on S3 buckets.
- ✗
Use S3 Block Public Access at the account level.
Why it's wrong here
Block Public Access does not enforce encryption.
- ✓
Use AWS CloudFormation Guard to validate templates before deployment.
Why this is correct
CloudFormation Guard can enforce encryption settings in templates.
- ✗
Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled.
Why it's wrong here
Config rule detects but does not prevent creation.
- ✓
Use a service control policy (SCP) to deny s3:CreateBucket if the bucket does not have encryption settings.
Why this is correct
SCPs can restrict actions based on conditions like encryption settings.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.