The answer is to create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag. This is correct because a Service Control Policy operates at the AWS Organizations root level, applying a guardrail across all accounts to enforce S3 bucket tagging without requiring per-account configuration or additional services like AWS Config or Lambda. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this scenario tests your understanding of SCPs as a preventative control for governance at scale, often contrasting with reactive solutions like post-creation tagging via CloudTrail events. A common trap is choosing a solution that requires ongoing maintenance, such as a custom Lambda function, which adds operational overhead. Remember the memory tip: SCPs are the "bouncer at the door" — they deny entry before the bucket is created, not after.
PAS-C01 Operations and Maintenance Practice Question
This PAS-C01 practice question tests your understanding of operations and maintenance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.
Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.
Why this is correct
Prevents creation of untagged buckets, enforcing compliance proactively.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.
Why it's wrong here
Reactive approach; buckets exist untagged for a period.
✗
Configure each account's S3 bucket creation process to include tagging.
Why it's wrong here
Requires manual effort in each account and may be missed.
✗
Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.
Why it's wrong here
Only alerts; does not enforce tagging.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose AWS Config or Lambda solutions because they are familiar with remediation workflows, but they overlook that SCPs provide preventive enforcement with zero operational overhead, which is the key requirement in the question.
Detailed technical explanation
How to think about this question
SCPs use AWS Identity and Access Management (IAM) policy language with a Deny effect and a Condition block using 'aws:RequestTag' to require the CostCenter tag on s3:CreateBucket requests. This works because SCPs are applied to all principals in the account, including root users, and cannot be overridden by account-level IAM policies. In a real-world scenario, if a developer uses the AWS Management Console to create a bucket without the tag, the SCP will block the action before the bucket is created, ensuring compliance without any post-creation cleanup.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Operations and Maintenance — This question tests Operations and Maintenance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag. — Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.
What should I do if I get this PAS-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.