SCS-C02 Question 486
Select 4Your organization is conducting an architectural review to identify potential security gaps and optimize costs for a multi-account AWS environment. During the review, you discover that some accounts are using Amazon S3 buckets with default encryption disabled and storing sensitive data. Additionally, unused EC2 instances with attached EBS volumes are running in multiple accounts. What actions should you recommend to address these security and cost concerns?
- A
Enable default encryption on all S3 buckets storing sensitive data.
- B
Implement an AWS Config rule to ensure S3 buckets have default encryption enabled.
- C
Shut down unused EC2 instances and delete their attached EBS volumes.
- D
Use AWS Trusted Advisor to identify and remediate unnecessary resources.
- E
Migrate all data from the S3 buckets to a single account to simplify management.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
This question evaluates your ability to identify security gaps and cost inefficiencies in an AWS architecture and recommend appropriate actions. Enabling default encryption on S3 buckets and using AWS Config to enforce compliance directly addresses the security gap. Shutting down unused EC2 instances and leveraging AWS Trusted Advisor help reduce unnecessary costs and identify misconfigurations. However, migrating data to a single account is not relevant to the identified issues and could create additional risks.
- A. Correct.
Enabling default encryption on S3 buckets ensures that sensitive data at rest is encrypted, addressing the security gap for data stored in S3.
- B. Correct.
An AWS Config rule can be used to monitor and enforce compliance by ensuring all S3 buckets have default encryption enabled, helping to prevent future misconfigurations.
- C. Correct.
Shutting down unused EC2 instances and deleting their attached EBS volumes reduces unnecessary costs in the environment, addressing the cost concern.
- D. Correct.
AWS Trusted Advisor provides insights into resource usage and security gaps. It can help identify unused resources and security misconfigurations, aiding in remediation.
- E. Incorrect.
Migrating data to a single account does not directly address the identified security and cost concerns. Moreover, centralizing all data in a single account could introduce other security and management challenges.