DOP-C02 Question 374
Select 2Your company processes sensitive customer data and must ensure compliance with data protection regulations. You are tasked with automating security controls to enforce encryption on all S3 buckets and detect any unencrypted buckets in real time. Which combination of actions should you implement to achieve this goal?
- A
Enable S3 bucket default encryption and configure an AWS Config rule to validate encryption compliance.
- B
Use an AWS Lambda function triggered by S3 events to check bucket policies for encryption requirements.
- C
Set up an S3 Event Notification to invoke an Amazon SNS topic and alert administrators for unencrypted objects.
- D
Implement an AWS Config rule to evaluate whether S3 buckets have server-side encryption enabled and remediate non-compliant buckets automatically.
- E
Use Amazon Macie to automatically discover and encrypt unencrypted S3 buckets.
Show answer and explanation
Correct answers: A, D
Explanation
To automate security controls and data protection for S3 buckets, enabling default encryption ensures that all new objects in a bucket are encrypted automatically. Config rules add a layer of monitoring and enable real-time compliance checks with automatic remediation, ensuring no bucket remains unencrypted. Other options either lack enforcement or are not designed for this specific purpose.
- A. Correct.
Correct. Enabling default encryption on S3 buckets ensures that all new objects are encrypted. AWS Config rules can monitor compliance and detect unencrypted buckets.
- B. Incorrect.
Incorrect. While Lambda can be used for custom checks, this approach does not natively enforce encryption or provide automated remediation.
- C. Incorrect.
Incorrect. S3 Event Notifications can alert administrators but do not enforce encryption compliance or automate remediation.
- D. Correct.
Correct. AWS Config can evaluate bucket encryption settings and use remediation actions to enforce compliance automatically, aligning with the requirements.
- E. Incorrect.
Incorrect. Amazon Macie specializes in identifying sensitive data but does not enforce encryption on S3 buckets automatically.