DOP-C02 Question 256
Select 2Your organization needs to ensure compliance by enforcing that all S3 buckets are encrypted using AWS KMS-managed keys. You want to use AWS Config to monitor and remediate non-compliant buckets automatically. Which combination of actions will achieve this requirement?
- A
Create an AWS Config managed rule 's3-bucket-server-side-encryption-enabled' and set it to compliant only for AWS KMS-managed keys.
- B
Create a custom AWS Config rule with a Lambda function to identify non-compliant S3 buckets.
- C
Enable the AWS Config rule remediation action to automatically apply server-side encryption with AWS KMS-managed keys to non-compliant buckets.
- D
Set up an Amazon EventBridge rule to trigger a Lambda function for remediation when an AWS Config rule marks a bucket as non-compliant.
- E
Use AWS Config aggregator to aggregate compliance data from multiple accounts in the organization.
Show answer and explanation
Correct answers: A, C
Explanation
The managed rule 's3-bucket-server-side-encryption-enabled' is purpose-built to monitor S3 buckets for encryption compliance. Additionally, AWS Config's remediation actions allow for automatic application of encryption settings to non-compliant S3 buckets, fulfilling the requirement without the need for custom Lambda functions or EventBridge rules. Aggregators are not relevant for enforcing compliance in this scenario.
- A. Correct.
This is a valid action. The AWS Config managed rule 's3-bucket-server-side-encryption-enabled' can be configured to check for buckets encrypted with AWS KMS-managed keys.
- B. Incorrect.
While creating a custom AWS Config rule is possible, this scenario does not require it because an AWS Config managed rule can achieve the requirement without custom code.
- C. Correct.
This is correct. AWS Config supports remediation actions, and you can configure it to automatically apply server-side encryption using AWS KMS-managed keys to non-compliant buckets.
- D. Incorrect.
While this is technically possible, using an EventBridge rule and Lambda function for remediation is unnecessary because AWS Config supports built-in remediation actions.
- E. Incorrect.
This is unrelated to the scenario. AWS Config aggregators are used to collect compliance data across multiple accounts or regions, but they do not enforce compliance or remediate resources.