SAP-C02 Question 67
Select 3A financial institution has strict compliance requirements and needs to ensure that sensitive data stored in Amazon S3 is not publicly accessible. They also need to monitor and receive alerts for any new IAM policies that allow overly permissive access to their resources. Which combination of AWS tools should you use to meet these requirements?
- A
AWS CloudTrail to monitor API activity and AWS Security Hub to assess compliance
- B
AWS Identity and Access Management (IAM) Access Analyzer to detect public and cross-account access
- C
Amazon Inspector to monitor for vulnerabilities in S3 buckets
- D
AWS Config to evaluate S3 bucket policies and AWS Security Hub to aggregate findings
- E
AWS Trusted Advisor to automatically block public access to S3 buckets
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, the financial institution should use a combination of tools. AWS IAM Access Analyzer can detect overly permissive access policies, AWS Config can evaluate the compliance of S3 bucket policies, and AWS Security Hub can aggregate findings from multiple services to provide actionable compliance insights. While AWS CloudTrail and Trusted Advisor are useful for other security-related tasks, they do not directly address the specific requirements in this scenario.
- A. Correct.
AWS CloudTrail tracks API activity and provides event history, but it does not directly assess bucket policies or IAM permissions for compliance.
- B. Correct.
AWS IAM Access Analyzer can detect overly permissive access by analyzing resource policies, including identifying S3 buckets that are publicly accessible.
- C. Incorrect.
Amazon Inspector is primarily used for scanning EC2 instances, container images, and Lambda functions for vulnerabilities, not for monitoring S3 buckets or IAM policies.
- D. Correct.
AWS Config evaluates the compliance of S3 bucket configurations and policies, while AWS Security Hub aggregates and prioritizes findings from multiple services to provide a holistic compliance view.
- E. Incorrect.
AWS Trusted Advisor provides recommendations for cost optimization, performance, and security, but it does not automatically block public access to S3 buckets or monitor IAM policies.