SCS-C02 Question 483
Select 3Your company recently implemented AWS Config to track the configuration changes of your AWS resources. As the security engineer, you have been tasked with ensuring that all S3 buckets in your account have server-side encryption enabled. Additionally, you need to continuously monitor compliance and receive alerts if a bucket becomes non-compliant. Which combination of actions should you take to meet this requirement?
- A
Create an AWS Config rule that evaluates whether S3 buckets have server-side encryption enabled.
- B
Enable AWS Config recording for all supported resources across all regions.
- C
Set up an Amazon SNS topic and configure AWS Config to send notifications for non-compliant resources.
- D
Use Amazon CloudWatch Logs to monitor AWS Config changes and trigger an alert for non-compliant buckets.
- E
Manually review the encryption settings of all S3 buckets every week.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirement, you need to use AWS Config to evaluate whether S3 buckets have server-side encryption enabled by creating a Config rule. Enabling AWS Config recording ensures that the service tracks resource configurations, and setting up an Amazon SNS topic ensures you receive compliance notifications. This approach provides automated, continuous monitoring and alerting, which is more efficient and reliable than manual reviews or relying solely on CloudWatch Logs.
- A. Correct.
Correct. AWS Config rules allow you to evaluate the compliance of resources, such as checking whether S3 buckets have server-side encryption enabled.
- B. Correct.
Correct. AWS Config must be enabled and recording for it to track and evaluate the configuration changes of your resources.
- C. Correct.
Correct. Configuring an SNS topic allows you to receive notifications about non-compliant resources, ensuring you remain informed of any issues.
- D. Incorrect.
Incorrect. While CloudWatch Logs can provide insights into AWS Config operations, it is not the recommended approach for triggering compliance alerts. AWS Config notifications through SNS are more appropriate for this use case.
- E. Incorrect.
Incorrect. Manually reviewing settings is inefficient, error-prone, and does not provide continuous monitoring or automated compliance checks.