SAP-C02 AWS Config Practice Question

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

⚠ Common exam trap

The trap is that Option E might seem correct because it mentions encryption and public access, but it does not actually prohibit public access—it only ties the ability to modify public access settings to having encryption enabled. The correct SCP for prohibiting public access would be one that outright denies actions that grant public access, which is not listed. Thus, remediation via AWS Config (Option A) is needed to actively fix public access violations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS Config rules to automatically remediate non-compliant buckets.

Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use AWS Config rules to automatically remediate non-compliant buckets.
Why this is correct
Correct. AWS Config rules can detect non-compliant buckets for both encryption and public access, and trigger automatic remediation actions (e.g., enable encryption or block public access) to enforce compliance.
✗
Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.
Why it's wrong here
Incorrect. CloudTrail logs API calls for auditing but does not automatically remediate non-compliance.
✓
Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.
Why this is correct
Correct. This SCP prevents objects from being uploaded without KMS encryption, enforcing encryption at the object level across all accounts.
✗
Create an S3 bucket policy in each account to enforce encryption and block public access.
Why it's wrong here
Incorrect. S3 bucket policies are per-account and can be overridden by account administrators; SCPs provide organization-wide control.
✗
Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.
Why it's wrong here
Incorrect. This SCP denies PutBucketPublicAccessBlock and PutBucketPolicy only if encryption is not enabled, but does not prohibit public access; if encryption is enabled, those actions can still be used to allow public access.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 AWS Config Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question