SAP-C02 Continuous Improvement for Existing Solutions Practice Question

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an SCP that denies s3:CreateBucket unless encryption is specified.

A service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create an SCP that denies s3:CreateBucket unless encryption is specified.
Why this is correct
SCPs can deny actions based on conditions like encryption.
✗
Use CloudTrail to monitor bucket creation and alert security team.
Why it's wrong here
Reactive, not preventive.
✗
Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.
Why it's wrong here
Incorrect action; SCP should deny PutBucket with specific conditions.
✗
Use AWS Config rules to detect non-compliant buckets and auto-remediate.
Why it's wrong here
This detects but does not prevent.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question