hardMultiple Choice
CCSP Organization-level policy Practice Question
A company uses a cloud provider's organization management with multiple accounts. A security team wants to ensure that a specific storage bucket in the production account cannot be deleted by anyone, including the account administrator. Which control should be implemented?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (like organization-level policies) and detective/reactive controls (like audit logging or notifications), and the trap here is that candidates confuse logging or versioning with actual deletion prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization-level policy to deny the delete action on the bucket for the production account.
An organization-level policy can be applied to an account (or organizational unit) to restrict permissions for all users, roles, and even the account administrator. By attaching a policy that denies the action to delete a storage bucket, the security team ensures that no principal in the production account can delete the specified bucket. This provides a preventive control that overrides any allow permissions within the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use notifications to alert when a delete is attempted.
Why it's wrong here
Notifications merely alert personnel once a delete has been attempted, leaving the bucket removable. Alerting suits scenarios needing timely awareness of configuration changes, not hard prevention of deletion by any principal including the account administrator.
- ✗
Enable versioning on the bucket.
Why it's wrong here
Versioning preserves prior object versions after deletion, so the bucket itself can still be removed; it addresses recoverability, not prevention. Versioning is correct when the requirement is retaining object history against accidental overwrite or deletion.
- ✗
Enable audit logging to log any deletion attempt.
Why it's wrong here
Audit logging records deletion attempts after the fact, providing detection and evidence rather than blocking the action. Logging is correct where the requirement is forensic traceability or compliance monitoring, not preventing an administrator from deleting a resource.
- ✓
Apply an organization-level policy to deny the delete action on the bucket for the production account.
Why this is correct
An organization-level policy overrides account-level permissions, so even the production account administrator cannot delete the bucket. This satisfies the stem's constraint that nobody, including that administrator, may delete it. Service control policies in AWS Organizations or equivalent deny rules enforce this centrally across accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.