Question 130 of 1,570
Enforce S3 Bucket Encryption Across All Accounts
A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?
Quick Answer
The answer is to apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings. This is the most operationally efficient solution because it proactively prevents noncompliant buckets from being created at the source, using AWS Organizations to enforce encryption requirements across all accounts without relying on post-creation detection or remediation. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of preventive versus detective controls, with SCPs serving as a guardrail at the organization level—a common trap is choosing a reactive Lambda or AWS Config rule, which only catches violations after the fact. Remember the key distinction: SCPs block the action before it happens, while other options merely report or fix it later. A useful memory tip is “SCP stops the bucket before it drops,” reinforcing that the policy denies the creation request upfront.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.
Applying an SCP to the root organizational unit that denies s3:CreateBucket unless encryption settings are specified is the most operationally efficient because it prevents noncompliant buckets from being created at the organizational level. Option A (Lambda triggered by S3 events) is reactive and requires ongoing management. Option B (setting default encryption per account) does not enforce across all accounts and can be overridden. Option D (AWS Config rule with remediation) only detects and fixes noncompliant buckets after creation, which is less efficient than prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.
Why it's wrong here
This is reactive and requires additional permissions; also event notifications are not generated for bucket creation.
- ✗
Set a default bucket encryption policy in each account’s S3 console.
Why it's wrong here
This must be done per account and does not enforce compliance across the organization.
- ✓
Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.
Why this is correct
SCPs can deny actions with conditions, preventing noncompliant bucket creation across all accounts.
- ✗
Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.
Why it's wrong here
This detects noncompliant buckets but does not prevent creation; remediation is reactive.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?
medium- A.Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.
- B.Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.
- ✓ C.Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.
- D.Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.
Why C: AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.
Variation 2. A company has an AWS environment with multiple accounts managed under AWS Organizations. The security team wants to enforce that all newly created S3 buckets in any account have encryption enabled by default. Which approach should the security team take?
medium- A.Use AWS Config rules to detect unencrypted buckets and send alerts.
- B.Enable S3 default encryption in each account's S3 settings.
- C.Apply an IAM policy to the root user of each account to enforce bucket encryption.
- ✓ D.Create a Service Control Policy (SCP) that denies the creation of S3 buckets without encryption.
Why D: A Service Control Policy (SCP) can be applied at the organizational level to deny the creation of S3 buckets without encryption, enforcing the policy across all accounts proactively. Option A is wrong because AWS Config rules are reactive and only detect violations after buckets are created. Option B is wrong because S3 default encryption is a bucket-level setting that must be configured per bucket, not an organization-wide enforcement. Option C is wrong because IAM policies are account-specific and cannot be centrally enforced across all accounts in the organization.
Last reviewed: Jun 20, 2026
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.