← SAP-C02·Amazon Web Services

Question 274 of 1,746

Design Solutions for Organizational Complexity →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption. This is correct because SCPs act as a centralized guardrail across all accounts in an organization, proactively blocking non-compliant actions before they occur, unlike reactive tools like AWS Config rules. By enforcing S3 bucket encryption and denying anonymous access with SCP at the organization root or OU level, you prevent any account—including the root user—from creating unencrypted objects or granting public access, eliminating the need for per-account or per-bucket configurations. On the SAP-C02 exam, this scenario tests your understanding of preventive versus detective controls and the boundary-defining power of SCPs over IAM policies; a common trap is choosing AWS Config, which only detects violations after the fact. Memory tip: SCPs are the “bouncer” at the organization door—they stop bad actions before they enter, while Config is just the security camera that records them.

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A
Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.
Why wrong: IAM roles cannot enforce policies on the root user and require manual setup per account.
B
Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.
SCPs centrally enforce restrictions across all accounts, covering all users including root.
C
Use S3 bucket policies with Deny statements for anonymous access and missing encryption.
Why wrong: Bucket policies must be applied to each bucket individually, which is not efficient for many buckets.
D
Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.
Why wrong: Config rules are detective, not preventive; remediation may have delays and not prevent initial violations.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.

Option C is correct because SCPs can centrally deny actions across all accounts in an organization, enforcing encryption and blocking anonymous access without requiring changes to each account. Option A (IAM roles) requires per-account setup and cannot prevent root user actions. Option B (bucket policies) must be applied per bucket. Option D (AWS Config rules) can detect violations but not prevent them proactively.

Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.
Why it's wrong here
IAM roles cannot enforce policies on the root user and require manual setup per account.
✓
Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.
Why this is correct
SCPs centrally enforce restrictions across all accounts, covering all users including root.
Related concept
Static NAT maps one inside address to one outside address.
✗
Use S3 bucket policies with Deny statements for anonymous access and missing encryption.
Why it's wrong here
Bucket policies must be applied to each bucket individually, which is not efficient for many buckets.
✗
Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.
Why it's wrong here
Config rules are detective, not preventive; remediation may have delays and not prevent initial violations.

Common exam traps

Common exam trap: NAT rules depend on direction and matching traffic

NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.

Detailed technical explanation

How to think about this question

NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.

KKey Concepts to Remember

Static NAT maps one inside address to one outside address.
PAT allows many inside hosts to share one public address using ports.
Inside local and inside global describe the private and translated addresses.
NAT ACLs identify traffic for translation, not always security filtering.

TExam Day Tips

Identify inside and outside interfaces first.
Check whether the scenario needs static NAT, dynamic NAT or PAT.
Do not confuse NAT matching ACLs with normal packet-filtering intent.

Key takeaway

NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related SAP-C02 NAT questions on configuration and troubleshooting.

Related SAP-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design Solutions for Organizational Complexity practice questions

Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.

Design for New Solutions practice questions

Practise SAP-C02 questions linked to Design for New Solutions.

Continuous Improvement for Existing Solutions practice questions

Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.

Accelerate Workload Migration and Modernization practice questions

Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.

SAA-C03 VPC practice questions

Practise SAP-C02 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise SAP-C02 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAP-C02 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.

Practice this exam

Start a free SAP-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SAP-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SAP-C02 question test?

Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Static NAT maps one inside address to one outside address..

What is the correct answer to this question?

The correct answer is: Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption. — Option C is correct because SCPs can centrally deny actions across all accounts in an organization, enforcing encryption and blocking anonymous access without requiring changes to each account. Option A (IAM roles) requires per-account setup and cannot prevent root user actions. Option B (bucket policies) must be applied per bucket. Option D (AWS Config rules) can detect violations but not prevent them proactively.

What should I do if I get this SAP-C02 question wrong?

What is the key concept behind this question?

Static NAT maps one inside address to one outside address.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

medium

A.Attach a bucket policy to each bucket that denies PutObject without encryption.
✓ B.Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.
C.Create an IAM policy that denies s3:PutObject unless encryption is specified.
D.Enable S3 Block Public Access at the organization level.
✓ E.Use AWS Config rules to detect S3 buckets without encryption and automatically apply encryption.

Why B: Options A and B are correct. SCP can deny creation of unencrypted buckets, and Config can detect noncompliant buckets. Option C is wrong because bucket policies can be bypassed by bucket owners. Option D is wrong because IAM policies are per-account and may not cover all principals. Option E is wrong because S3 Block Public Access does not address encryption.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.