Enforce S3 Encryption with SCP, AWS Config, and Default Encryption
A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)
Quick Answer
The correct three steps are to enforce S3 encryption using a service control policy, AWS Config rules, and default encryption on all buckets. A service control policy at the organizational level can deny the creation of unencrypted S3 buckets, while AWS Config rules continuously evaluate existing buckets for compliance and trigger remediation if encryption is missing. Default encryption on each bucket ensures that any new objects uploaded are automatically encrypted at rest, even if the upload request does not specify encryption headers. On the SAP-C02 exam, this scenario tests your ability to combine preventive, detective, and corrective controls across multiple accounts, a common theme in organizational security design. A frequent trap is confusing bucket policies with default encryption—bucket policies enforce encryption at upload time but cannot fix objects already stored. Remember the mnemonic: SCP prevents, Config detects, Default encrypts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.
A service control policy (SCP) can deny PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled, preventing disabling of encryption at the bucket level. Option D is correct because AWS Config managed rule s3-bucket-server-side-encryption-enabled can detect S3 buckets that lack server-side encryption. Option E is correct because enabling default encryption on all S3 buckets ensures that new objects are automatically encrypted. Option A is incorrect because while an S3 bucket policy can enforce encryption on uploads, it does not enforce encryption on existing objects and must be applied per bucket; moreover, it is not an organization-wide enforcement mechanism. Option C is incorrect because AWS CloudTrail only logs API calls and does not enforce encryption; it can alert but does not remediate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply an S3 bucket policy on each bucket that denies PutObject without encryption.
Why it's wrong here
Bucket policies enforce at upload time, but cannot retroactively encrypt existing objects.
- ✓
Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.
Why this is correct
SCPs can restrict actions that create unencrypted buckets.
- ✗
Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.
Why it's wrong here
CloudTrail logs events but does not enforce encryption.
- ✓
Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled to detect non-compliant buckets.
Why this is correct
AWS Config rule detects buckets without encryption.
- ✓
Enable default encryption on all S3 buckets using the AWS S3 console or API.
Why this is correct
Default encryption ensures new objects are encrypted automatically.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?
medium- ✓ A.Use AWS Config rules to automatically remediate non-compliant buckets.
- B.Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.
- ✓ C.Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.
- D.Create an S3 bucket policy in each account to enforce encryption and block public access.
- E.Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.
Why A: Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.
Variation 2. A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?
easy- ✓ A.Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.
- ✓ B.Create a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present.
- C.Use Amazon GuardDuty to monitor S3 data access patterns.
- D.Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.
- E.Enable AWS CloudTrail to log all S3 API calls.
Why A: AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.