SCS-C02 Question 471
Single answerYour company has implemented an AWS Config rule to ensure that all S3 buckets are encrypted with server-side encryption. During a routine compliance evaluation, you discover that some S3 buckets are non-compliant. What action can you take to automatically remediate these non-compliant resources?
- A
Set up an AWS Config remediation action to enable default encryption on the buckets.
- B
Manually update the non-compliant S3 buckets to enable server-side encryption.
- C
Create an Amazon EventBridge rule that triggers a Lambda function to delete non-compliant buckets.
- D
Configure AWS Config to automatically delete non-compliant resources.
Show answer and explanation
Correct answer: A
Explanation
AWS Config allows you to evaluate the compliance of AWS resources against specified rules. When resources are non-compliant, you can configure remediation actions to automatically resolve the issues. For S3 buckets, enabling default encryption is a common remediation action to enforce compliance with encryption policies.
- A. Correct.
This is the correct answer. AWS Config supports remediation actions, which can be configured to automatically fix non-compliant resources, such as enabling default encryption for S3 buckets.
- B. Incorrect.
While this is technically possible, it is a manual action and not an automated remediation, which does not align with the question's requirement for automatic remediation.
- C. Incorrect.
This is not recommended, as deleting non-compliant buckets is a drastic action and may lead to data loss. Additionally, AWS Config does not natively support this approach.
- D. Incorrect.
AWS Config does not have a feature to automatically delete non-compliant resources. It focuses on monitoring and providing remediation actions when configured.