SAP-C02 Question 412
Single answerA company wants to ensure compliance with its security policies by automatically detecting and remediating non-compliant resources in its AWS environment. For example, the company requires all S3 buckets to have server-side encryption enabled. Which solution should you implement to achieve this requirement?
- A
Use AWS Config with a managed rule to check for S3 bucket encryption and set up an automatic remediation action to enable encryption.
- B
Use an Amazon CloudWatch alarm to monitor S3 bucket configurations and trigger an AWS Lambda function to enable encryption.
- C
Set up an AWS Systems Manager Automation document to periodically scan S3 buckets and apply encryption to non-compliant ones.
- D
Create an Amazon EventBridge rule to detect S3 bucket creation events and enable encryption using an AWS Lambda function.
Show answer and explanation
Correct answer: A
Explanation
AWS Config is the best service for ensuring continuous compliance with your organization's policies. Managed rules, such as the one for S3 bucket encryption, can be used to detect non-compliant resources automatically, and remediation actions can be configured to fix issues without manual intervention. This ensures that security policies are enforced consistently across the environment.
- A. Correct.
This is the correct answer. AWS Config allows you to use managed rules to automatically check for compliance, and you can associate automatic remediation actions to fix non-compliant resources, such as enabling server-side encryption for S3 buckets.
- B. Incorrect.
This is incorrect. CloudWatch alarms are designed for monitoring metrics, not for compliance checks or automatic remediation of resource configurations.
- C. Incorrect.
This is incorrect. AWS Systems Manager Automation documents are not designed for continuous compliance monitoring and automatic remediation. They are better suited for manual or scheduled tasks.
- D. Incorrect.
This is incorrect. While EventBridge can detect events such as S3 bucket creation, this approach does not continuously monitor all S3 buckets for compliance, nor does it integrate with AWS Config’s compliance framework.