DOP-C02 Question 319
Select 3Your organization has a compliance requirement to ensure that all Amazon S3 buckets are encrypted using server-side encryption. You are tasked with setting up a solution to automatically detect and remediate any non-compliant S3 buckets. Which combination of actions using AWS Config should you take to meet this requirement?
- A
Create an AWS Config rule to check whether S3 bucket encryption is enabled and set it to automatically remediate non-compliant resources.
- B
Enable AWS Config to record configuration changes for all S3 buckets in the account.
- C
Use an AWS Lambda function triggered by an AWS Config rule to apply encryption to non-compliant S3 buckets.
- D
Create an Amazon EventBridge rule to monitor S3 bucket changes and trigger an AWS Config evaluation.
- E
Manually review the AWS Config console for non-compliant S3 buckets and apply encryption as needed.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirement for automatic detection and remediation of non-compliant S3 buckets, you need to enable AWS Config to record resource changes, create a managed rule to check for S3 bucket encryption compliance, and configure automatic remediation using an AWS Lambda function. This ensures compliance is continuously monitored and enforced without manual intervention.
- A. Correct.
Correct. AWS Config provides managed rules, such as 's3-bucket-server-side-encryption-enabled,' which can automatically check bucket compliance and remediate non-compliance using automation.
- B. Correct.
Correct. AWS Config must be enabled and configured to record resource changes, such as S3 bucket configurations, to evaluate compliance.
- C. Correct.
Correct. AWS Lambda can be used to apply encryption to non-compliant S3 buckets as part of an automatic remediation action triggered by an AWS Config rule.
- D. Incorrect.
Incorrect. While Amazon EventBridge can monitor resource changes, it is not required in this scenario because AWS Config natively handles compliance evaluations and remediation triggers.
- E. Incorrect.
Incorrect. Manually reviewing the AWS Config console does not meet the requirement for automatic detection and remediation.