hardMultiple ChoiceObjective-mapped
CCSP Organization-level policy Practice Question
A company uses a cloud provider's organization management with multiple accounts. A security team wants to ensure that a specific storage bucket in the production account cannot be deleted by anyone, including the account administrator. Which control should be implemented?
⚠ Common exam trap
ISC2 often tests the distinction between preventive controls (like organization-level policies) and detective/reactive controls (like audit logging or notifications), and the trap here is that candidates confuse logging or versioning with actual deletion prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization-level policy to deny the delete action on the bucket for the production account.
An organization-level policy can be applied to an account (or organizational unit) to restrict permissions for all users, roles, and even the account administrator. By attaching a policy that denies the action to delete a storage bucket, the security team ensures that no principal in the production account can delete the specified bucket. This provides a preventive control that overrides any allow permissions within the account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use notifications to alert when a delete is attempted.
Why it's wrong here
Incorrect. Notifications alert after a deletion attempt occurs but do not prevent it.
- ✗
Enable versioning on the bucket.
Why it's wrong here
Incorrect. Versioning allows recovery of deleted objects but does not prevent the bucket itself from being deleted.
- ✗
Enable audit logging to log any deletion attempt.
Why it's wrong here
Incorrect. Audit logging records deletion attempts but does not prevent them.
- ✓
Apply an organization-level policy to deny the delete action on the bucket for the production account.
Why this is correct
Correct. An organization-level policy can deny the delete action on the bucket for all principals, including the account administrator.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.