- A
Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.
Why wrong: Incorrect. SCPs cannot enforce versioning during bucket creation because the versioning configuration is set after bucket creation using PutBucketVersioning. The headers mentioned in the explanation do not exist. SCPs can deny actions but cannot require specific API parameters that do not exist.
- B
Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.
Why wrong: Incorrect. CloudTrail alerts only notify after the fact; they do not prevent noncompliant buckets or enforce compliance automatically.
- C
Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.
Why wrong: Incorrect. IAM policies attached to users are not enforceable at the OU level and can be bypassed by users with sufficient permissions (e.g., admin). Additionally, versioning cannot be enforced at creation time via IAM conditions.
- D
Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.
Correct. AWS Config evaluates bucket configurations and uses custom Lambda functions to auto-remediate, enabling versioning and KMS encryption for any noncompliant bucket. This provides automated enforcement with acceptable operational overhead.
SAP-C02 S3 Versioning Practice Question
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: s3 Versioning. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.
Option D is correct because it uses AWS Config rules to detect noncompliant S3 buckets (e.g., missing versioning or KMS encryption) and triggers an automated Lambda remediation to enable versioning and encryption. This ensures compliance with minimal manual intervention, though it does incur some operational overhead for Lambda maintenance. Option A is incorrect because SCPs cannot enforce versioning at bucket creation—versioning is enabled after creation via PutBucketVersioning, and the headers mentioned in the explanation do not exist. Option B only alerts and does not enforce. Option C is not scalable for OU-level enforcement and can be bypassed.
Key principle: S3 Versioning
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.
Why it's wrong here
Incorrect. SCPs cannot enforce versioning during bucket creation because the versioning configuration is set after bucket creation using PutBucketVersioning. The headers mentioned in the explanation do not exist. SCPs can deny actions but cannot require specific API parameters that do not exist.
- ✗
Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.
Why it's wrong here
Incorrect. CloudTrail alerts only notify after the fact; they do not prevent noncompliant buckets or enforce compliance automatically.
- ✗
Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.
Why it's wrong here
Incorrect. IAM policies attached to users are not enforceable at the OU level and can be bypassed by users with sufficient permissions (e.g., admin). Additionally, versioning cannot be enforced at creation time via IAM conditions.
- ✓
Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.
Why this is correct
Correct. AWS Config evaluates bucket configurations and uses custom Lambda functions to auto-remediate, enabling versioning and KMS encryption for any noncompliant bucket. This provides automated enforcement with acceptable operational overhead.
Related concept
S3 Versioning
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap is that candidates assume SCPs can enforce versioning at bucket creation because they are familiar with SCPs for preventive controls. However, versioning cannot be specified in the CreateBucket request; it must be enabled separately. Thus, the only viable option is AWS Config with auto-remediation (Option D), which is reactive but enforceable.
Detailed technical explanation
How to think about this question
SCPs use AWS Identity and Access Management (IAM) policy language with conditions like s3:x-amz-server-side-encryption-aws-kms-key-id and s3:VersioningEnabled to inspect API request parameters. Under the hood, SCPs are evaluated by AWS Organizations before the action is allowed, and they apply to all IAM users, roles, and service-linked roles in the OU, including root user, making them a preventive control. A real-world scenario is when a developer uses the AWS CLI without specifying --server-side-encryption aws:kms and --versioning Enabled; the SCP denies the request, ensuring compliance without requiring developer training.
KKey Concepts to Remember
- S3 Versioning
- Service Control Policy (SCP)
- AWS Config Auto-Remediation
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
S3 Versioning
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
What to study next
Got this wrong? Here's your next step.
Review s3 Versioning, then practise related SAP-C02 questions on the same topic to reinforce the concept.
- →
Design Solutions for Organizational Complexity — study guide chapter
Learn the concepts, then practise the questions
- →
Design Solutions for Organizational Complexity practice questions
Targeted practice on this topic area only
- →
All SAP-C02 questions
1,746 questions across all exam domains
- →
AWS Certified Solutions Architect Professional SAP-C02 study guide
Full concept coverage aligned to exam objectives
- →
SAP-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SAP-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Design Solutions for Organizational Complexity practice questions
Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.
Design for New Solutions practice questions
Practise SAP-C02 questions linked to Design for New Solutions.
Continuous Improvement for Existing Solutions practice questions
Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.
Accelerate Workload Migration and Modernization practice questions
Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.
SAA-C03 VPC practice questions
Practise SAP-C02 questions linked to SAA-C03 VPC.
SAA-C03 S3 lifecycle policy questions
Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.
SAA-C03 RDS Multi-AZ questions
Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.
SAA-C03 IAM policy practice questions
Practise SAP-C02 questions linked to SAA-C03 IAM policy.
SAA-C03 Route 53 failover questions
Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.
SAA-C03 CloudFront practice questions
Practise SAP-C02 questions linked to SAA-C03 CloudFront.
SAA-C03 NAT gateway questions
Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.
SAA-C03 VPC endpoint questions
Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.
Practice this exam
Start a free SAP-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SAP-C02 question test?
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — S3 Versioning.
What is the correct answer to this question?
The correct answer is: Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda. — Option D is correct because it uses AWS Config rules to detect noncompliant S3 buckets (e.g., missing versioning or KMS encryption) and triggers an automated Lambda remediation to enable versioning and encryption. This ensures compliance with minimal manual intervention, though it does incur some operational overhead for Lambda maintenance. Option A is incorrect because SCPs cannot enforce versioning at bucket creation—versioning is enabled after creation via PutBucketVersioning, and the headers mentioned in the explanation do not exist. Option B only alerts and does not enforce. Option C is not scalable for OU-level enforcement and can be bypassed.
What should I do if I get this SAP-C02 question wrong?
Review s3 Versioning, then practise related SAP-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
S3 Versioning
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More SAP-C02 practice questions
- A company wants to automate the migration of on-premises servers to AWS. The migration plan includes discovery, assessme…
- A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS…
- A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enf…
- A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC…
- A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used…
- Match each AWS compute service to its use case.
Last reviewed: Jun 11, 2026
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.