SAP-C02 AWS Config Conformance Packs Practice Question

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

⚠ Common exam trap

A common trap is confusing conformance packs with individual AWS Config rules. Conformance packs can be deployed organization-wide, but a single rule in the management account does not propagate to all accounts.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a conformance pack in the management account and deploy it to the organization.

To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources. Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.
Why it's wrong here
Incorrect. CloudFormation StackSets can deploy resources across accounts, but they do not automatically enable AWS Config itself, which is required for rules to evaluate.
✗
Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.
Why it's wrong here
Incorrect. An SCP denying PutBucketEncryption would prevent setting encryption, but the goal is to require encryption, and it does not create an AWS Config rule.
✓
Create a conformance pack in the management account and deploy it to the organization.
Why this is correct
Correct. A conformance pack deployed to the organization from the management account applies AWS Config rules to all existing and new accounts.
✗
Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.
Why it's wrong here
Incorrect. AWS Config rules are per-account; a rule in the management account does not apply to other accounts unless using conformance packs or automated deployment.
✓
Enable AWS Config in every account of the organization.
Why this is correct
Correct. AWS Config must be enabled in each account (and region) for the rules to evaluate resources. This is a prerequisite.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 AWS Config Conformance Packs Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question