SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation
AWS Config conformance packs with remediation via Systems Manager Automation can be deployed across all accounts in an AWS Organization. This allows automatic detection and remediation of non-compliant S3 buckets (e.g., lacking encryption or having public read access) in near real-time, providing a scalable and operationally efficient solution without custom code. Option A (SCPs) can prevent public access policies but cannot enforce encryption on existing buckets. Option C (CloudWatch Events) requires per-account setup and custom Lambda functions, and does not cover bucket modifications. Option D (daily Lambda scans) is not real-time and does not provide automatic remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption
Why it's wrong here
SCPs cannot enforce encryption on existing objects.
- ✓
Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation
Why this is correct
Provides continuous compliance and automatic remediation across the organization.
- ✗
Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption
Why it's wrong here
Reactive and does not cover all changes.
- ✗
Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts
Why it's wrong here
Not real-time and requires manual remediation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
7 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?
hard- A.Use AWS Config rules with auto-remediation using SSM Automation.
- B.Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.
- C.Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.
- ✓ D.Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.
Why D: A service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly. Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.
Variation 2. A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?
hard- A.Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.
- ✓ B.Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.
- C.Create an AWS Config rule in each account to remediate non-compliant buckets.
- D.Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.
Why B: Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.
Variation 3. A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)
hard- A.Apply an S3 bucket policy on each bucket that denies PutObject without encryption.
- ✓ B.Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.
- C.Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.
- ✓ D.Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled to detect non-compliant buckets.
- ✓ E.Enable default encryption on all S3 buckets using the AWS S3 console or API.
Why B: A service control policy (SCP) can deny PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled, preventing disabling of encryption at the bucket level. Option D is correct because AWS Config managed rule s3-bucket-server-side-encryption-enabled can detect S3 buckets that lack server-side encryption. Option E is correct because enabling default encryption on all S3 buckets ensures that new objects are automatically encrypted. Option A is incorrect because while an S3 bucket policy can enforce encryption on uploads, it does not enforce encryption on existing objects and must be applied per bucket; moreover, it is not an organization-wide enforcement mechanism. Option C is incorrect because AWS CloudTrail only logs API calls and does not enforce encryption; it can alert but does not remediate.
Variation 4. A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?
easy- A.AWS Resource Access Manager
- B.AWS WAF
- C.AWS IAM Identity Center (SSO)
- ✓ D.AWS Config
- ✓ E.AWS Organizations Service Control Policies (SCPs)
Why D: AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies. Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.
Variation 5. A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?
medium- ✓ A.Create an SCP that denies s3:CreateBucket unless encryption is specified.
- B.Use CloudTrail to monitor bucket creation and alert security team.
- C.Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.
- D.Use AWS Config rules to detect non-compliant buckets and auto-remediate.
Why A: A service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.
Variation 6. A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?
medium- ✓ A.Use AWS Config rules to automatically remediate non-compliant buckets.
- B.Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.
- ✓ C.Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.
- D.Create an S3 bucket policy in each account to enforce encryption and block public access.
- E.Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.
Why A: Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.
Variation 7. A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?
easy- ✓ A.Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.
- ✓ B.Create a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present.
- C.Use Amazon GuardDuty to monitor S3 data access patterns.
- D.Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.
- E.Enable AWS CloudTrail to log all S3 API calls.
Why A: AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.