The correct solution is to use AWS Config with the managed rule `s3-bucket-versioning-enabled` and configure auto-remediation via an AWS Systems Manager Automation document. This works because AWS Config continuously evaluates your S3 buckets against the rule, and when it detects a noncompliant bucket—one created without versioning—it triggers an automatic remediation action that runs the SSM Automation document to enable versioning directly on that bucket. This approach is fully event-driven and requires no manual intervention or bucket creation blocks, making it ideal for enforcing compliance across an entire AWS Organization. On the SAP-C02 exam, this scenario tests your understanding of AWS Config’s managed rules combined with Systems Manager Automation for remediation, often as a trap against less automated options like S3 lifecycle policies or Lambda functions that require custom code. A key memory tip: think “Config detects, SSM fixes”—the rule flags the violation, and the Automation document applies the fix, all without writing a single line of code.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Organizations and has a requirement that all Amazon S3 buckets must have versioning enabled. The company wants to automatically enable versioning on any bucket that is created without it. Which solution should be implemented?
Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.
Config rule detects and auto-remediates by enabling versioning.
B
Use an SCP to deny s3:CreateBucket unless versioning is enabled.
Why wrong: SCP can deny creation but does not enable versioning on existing buckets.
C
Use AWS Config to detect buckets without versioning and send an SNS notification.
Why wrong: Notifies but does not remediate.
D
Use AWS CloudFormation StackSets to deploy a bucket with versioning enabled in each account.
Why wrong: Only applies to buckets created via CloudFormation.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.
Option A is correct because AWS Config can detect S3 buckets without versioning using the managed rule `s3-bucket-versioning-enabled`, and then automatically remediate the noncompliant resource by invoking an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven solution that meets the requirement without manual intervention or blocking bucket creation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.
Why this is correct
Config rule detects and auto-remediates by enabling versioning.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use an SCP to deny s3:CreateBucket unless versioning is enabled.
Why it's wrong here
SCP can deny creation but does not enable versioning on existing buckets.
✗
Use AWS Config to detect buckets without versioning and send an SNS notification.
Why it's wrong here
Notifies but does not remediate.
✗
Use AWS CloudFormation StackSets to deploy a bucket with versioning enabled in each account.
Why it's wrong here
Only applies to buckets created via CloudFormation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose Option B (SCP) because they assume SCPs can enforce API-level conditions like versioning, but SCPs cannot evaluate request parameters that are not supported as condition keys in the IAM policy context.
Detailed technical explanation
How to think about this question
The AWS Config managed rule `s3-bucket-versioning-enabled` evaluates buckets against a desired `targetVersion` (e.g., `Enabled`). When auto-remediation is configured, AWS Config triggers an SSM Automation document (e.g., `AWS-EnableS3BucketVersioning`) that uses the `PutBucketVersioning` API to set the `VersioningConfiguration` status to `Enabled`. This remediation runs asynchronously, and the bucket becomes compliant within minutes. A subtle behavior is that AWS Config only evaluates resources that are in scope of the rule; if the bucket is created in a region not covered by the rule, it will not be remediated unless the rule is applied globally.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning. — Option A is correct because AWS Config can detect S3 buckets without versioning using the managed rule `s3-bucket-versioning-enabled`, and then automatically remediate the noncompliant resource by invoking an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven solution that meets the requirement without manual intervention or blocking bucket creation.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.