SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.

  Why this is correct

  Applying an SCP at the root organizational unit is the correct centralized method because SCPs act as guardrails that restrict the maximum permissions available to all IAM principals in every account under that OU, including the account root user. An SCP can, for example, use a condition like `s3:x-amz-server-side-encryption` or `aws:SecureTransport` to deny `s3:PutObject` calls that do not include encryption parameters, and because SCPs cannot be overridden by individual account administrators, this enforces encryption uniformly across the entire organization.

• ✗

  Configure an IAM role in the master account to enforce encryption via cross-account access.

  Why it's wrong here

  An IAM role in the master account does not enforce encryption; it only grants temporary credentials for cross-account access. To enforce anything, you would need to attach an IAM policy with a condition to that role, and the role would only affect users or services that explicitly assume it, not all actions across all member accounts. This approach is not a preventive control for the organization as a whole because it relies on principals choosing to use the role and does not apply to service principals or account root users.

• ✗

  Create an IAM policy in each account that denies s3:PutObject without encryption.

  Why it's wrong here

  Creating an IAM policy in each account is not a centralized guardrail because AWS Organizations does not propagate IAM policies across accounts; each account administrator would need to manually create and attach identical policies in every account. Moreover, IAM policies are identity-based and only apply to the IAM principals (users, roles, or groups) in that specific account, leaving out service-to-service actions, root users, and future accounts added to the organization. This method also creates inconsistency and maintenance overhead, and it does not prevent a misconfigured or newly onboarded account from bypassing encryption requirements.

• ✗

  Use AWS CloudFormation StackSets to deploy a bucket policy to each account.

  Why it's wrong here

  CloudFormation StackSets can deploy resources like bucket policies across accounts, but bucket policies are resource-based and only affect the specific S3 buckets they are attached to; they do not govern all S3 actions or all buckets in the account, especially buckets created outside of the StackSet template. StackSets also require you to define and continuously update the template whenever a new bucket is created, and there is no assurance that non-compliant buckets won't be created before the policy is applied. An SCP is superior because it is a preventive, organization-wide control that does not depend on per-resource configuration.

Go deeper

Related to this question