SCS-C02 Question 468
Single answerYour organization is required to maintain compliance with a regulatory standard that mandates encryption for all Amazon S3 buckets. As a security specialist, you need to evaluate whether all existing S3 buckets are compliant with this requirement. Which AWS service or feature should you use to efficiently assess the compliance of your S3 buckets with the encryption requirement?
- A
AWS Config with a managed rule to check bucket encryption
- B
Amazon Macie to classify data and detect unencrypted S3 buckets
- C
AWS Trusted Advisor to generate a compliance report for S3 encryption
- D
Amazon Inspector to scan S3 buckets for encryption compliance
Show answer and explanation
Correct answer: A
Explanation
AWS Config is the best choice for evaluating compliance of AWS resources, such as S3 buckets, against specific requirements. It offers managed rules that can automate the compliance check for encryption, saving time and ensuring accuracy compared to manual evaluation methods. In this case, Config's managed rule for S3 encryption is specifically designed for this purpose.
- A. Correct.
AWS Config provides managed rules, such as 's3-bucket-server-side-encryption-enabled,' which can evaluate and monitor the compliance of S3 bucket encryption. This is the most efficient method for this scenario.
- B. Incorrect.
Amazon Macie is primarily used for data classification and identifying sensitive data in S3 buckets, but it does not specifically evaluate bucket encryption compliance.
- C. Incorrect.
AWS Trusted Advisor can offer security best practice recommendations, but it does not provide a detailed compliance evaluation for S3 bucket encryption.
- D. Incorrect.
Amazon Inspector is a vulnerability management tool for EC2 instances and container images, and it does not support compliance checks for S3 buckets.