Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets trusted access

DOP-C02 By islever Editorial Last updated Oct 7, 2026

Apply automation for security controls and data protection. Deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environment.

Short answer

A Enforce encryption with a CloudFormation hook deployed across the OU using StackSets with trusted access.

Question

A company has an organization in AWS Organizations with many Oils that contain many AWS accounts. The organization has a dedicated delegated administrator AWS account. The company needs the accounts in one OU to have server-side encryption enforced for all Amazon Elastic Block Store (Amazon EBS) volumes and Amazon Simple Queue Service (Amazon SQS) queues that are created or updated on an AWS CloudFormation stack. Which solution will enforce this policy before a CloudFormation stack operation in the accounts of this OU?

Activate trusted access to CloudFormation StackSets. Create a CloudFormation Hook that enforces server-side encryption on EBS volumes and SQS queues. Deploy the Hook across the accounts in the OU by using StackSets. Correct Answer
Set up AWS Config in all the accounts in the OU. Use AWS Systems Manager to deploy AWS Config rules that enforce server-side encryption for EBS volumes and SQS queues across the accounts in the OU.
Write an SCP to deny the creation of EBS volumes and SQS queues unless the EBS volumes and SQS queues have server-side encryption. Attach the SCP to the OU.
Create an AWS Lambda function in the delegated administrator account that checks whether server-side encryption is enforced for EBS volumes and SQS queues. Create an IAM role to provide the Lambda function access to the accounts in the OU.

Key Takeaways

The phrase before a CloudFormation stack operation is what determines the answer, and only a CloudFormation hook operates at that point in the lifecycle (A). A hook validates or blocks the stack operation itself, so a noncompliant resource is never created, which is stronger than detection. StackSets with trusted access is the distribution mechanism that installs the hook into every account of the OU centrally (A). Options B and D detect after the fact, and C's SCP could only deny EBS and SQS resource creation outright rather than allowing compliant resources with encryption enabled.

The policy must be enforced before a CloudFormation stack operation proceeds in the accounts of the organizational unit, which means the control has to sit in the CloudFormation operation path itself rather than detect violations afterwards. A CloudFormation hook can intercept stack operations and validate that EBS volumes and SQS queues have server-side encryption before the resources are created or updated, failing the operation when they do not. Activating trusted access for CloudFormation StackSets and deploying the hook to every account in the OU with StackSets distributes that enforcement uniformly across the OU.

Common mistake: Setting up AWS Config and deploying Config rules with Systems Manager across the OU (B) — f4b18ba's point about detection versus prevention applies: Config evaluates configuration after the stack operation completes, so a resource created without encryption would already exist by the time the rule flags it, which does not satisfy a before-the-operation requirement. Writing an SCP that denies creating EBS volumes and SQS queues unless encrypted (C) — an SCP evaluates AWS API authorization and has no visibility into whether a CloudFormation template supplies an encryption setting, so using it would deny creation of these resources outright rather than validating the template's configuration, making compliant deployments impossible. Creating a Lambda in the delegated administrator account with an IAM role to access the OU accounts (D) — this is an out-of-band checking mechanism, not something in the stack operation path, so it cannot enforce policy before the operation proceeds.

Expert Analysis

Why the Answer Is Correct

The requirement is explicit that the policy be enforced before a CloudFormation stack operation, which places the control inside the CloudFormation operation lifecycle. A CloudFormation hook is the mechanism designed for this: it is invoked during stack operations and can perform validations that fail the operation before resources are created or updated, so a stack that would create an EBS volume or an SQS queue without server-side encryption is blocked rather than created and flagged afterwards (A). tubtab highlighted exactly this keyword, that the policy must be enforced before the stack operation. To apply that enforcement across every account in the organizational unit, trusted access for CloudFormation StackSets is activated and the hook is deployed to the accounts in the OU using StackSets, which distributes the same enforcement uniformly without manual per-account work (A). Ky_24 described the StackSets distribution model and f4b18ba explained that hooks intercept stack operations to validate or enforce policy before resources are created or updated. A is the correct answer.

Why the Other Options Are Wrong

B sets up AWS Config in the accounts of the OU and uses Systems Manager to deploy Config rules enforcing server-side encryption. AWS Config evaluates resource configuration after it exists, so a noncompliant EBS volume or SQS queue would already have been created by the time the rule reports it; this is detection rather than prevention and does not satisfy the requirement to enforce the policy before the stack operation proceeds. C writes an SCP denying the creation of EBS volumes and SQS queues unless they have server-side encryption. An SCP evaluates AWS API authorization and cannot inspect whether a CloudFormation template supplies an encryption setting, so in practice it would deny the creation of these resources outright rather than validating the template, which would make compliant deployments impossible as well as failing the before-the-operation intent. D creates a Lambda function in the delegated administrator account that checks whether server-side encryption is enforced, along with an IAM role giving it access to the accounts in the OU. This is an out-of-band inspection mechanism that runs independently of CloudFormation, so it cannot enforce anything at the moment a stack operation is submitted; it can only report afterwards. A is correct.

Community Comment Notes

Community voted A unanimously. Srikantha identified the decisive reasoning, that the company wants enforcement at resource creation time before a CloudFormation stack operation is allowed, and that CloudFormation hooks can validate or block the operation. tubtab named the keyword enforce this policy before a CloudFormation stack operation. Ky_24 explained that activating trusted access for StackSets and using StackSets distributes the hook across the accounts in the OU. f4b18ba explained that CloudFormation hooks intercept stack operations and perform validations or enforce policies before resources are created or updated, and separately noted elsewhere that detection-based options such as AWS Config and Lambda checks do not prevent the stack operation. No alternative received support.

Official Reference

These links open the official vendor documentation in a new tab.

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

f4b18ba 👍 3 Answered A

CloudFormation Hooks allow you to intercept stack operations and perform validations or enforce policies before resources are created or updated. Develop a CloudFormation Hook that checks whether EBS volumes and SQS queues in the CloudFormation templates have SSE enabled. Use CloudFormation StackSets with trusted access to deploy the Hook across all accounts in the OU. The Hook will validate templates and prevent non-compliant resources from being created or updated during stack operations. Applies only to resources managed via CloudFormation, aligning with the company's requirement. Centralized Deployment: StackSets allow you to deploy the Hook across multiple accounts and regions efficiently. Hooks do not interfere with non-CloudFormation operations, limiting the scope to what's required.
Ky_24 👍 3 Answered A

• CloudFormation StackSets allows you to deploy a CloudFormation template across multiple AWS accounts and regions in your organization. By enabling trusted access to CloudFormation StackSets, you can manage resources and apply policies uniformly across multiple accounts within the OU. • A CloudFormation Hook is a way to enforce specific policies or checks during stack operations. In this case, you can create a Hook to ensure that all EBS volumes and SQS queues created or updated in the CloudFormation stack have server-side encryption enabled. • The StackSet and Hook can be deployed across all accounts in the specified OU, ensuring that server-side encryption is automatically enforced before any stack operation proceeds, thus satisfying the company’s policy.
tubtab 👍 3 Answered A

KEYWORD enforce this policy before a CloudFormation stack operation
Srikantha 👍 1 Answered A

The company wants to enforce encryption at resource creation time before a CloudFormation stack operation is allowed. The best way to do that is by using CloudFormation Hooks, which can validate or block stack operations pre-deployment based on custom logic. CloudFormation Hooks allow you to enforce pre-provisioning checks. Hooks can block stack creations or updates that don’t meet compliance (e.g., unencrypted EBS volumes or SQS queues). You can deploy the Hook organization-wide using CloudFormation StackSets with trusted access enabled. This provides automated, consistent enforcement across accounts in an OU.
Changwha 👍 3 Answered A

The answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide