SCS-C02 Question 57
Select 2Your company has a compliance requirement to ensure that all S3 buckets storing sensitive data are encrypted and that encryption keys are rotated annually. You have been tasked with automating the detection of non-compliant buckets and alerting the security team. Which combination of AWS services and configurations should you implement to meet this requirement?
- A
Enable S3 default encryption on all buckets and use AWS Config with a managed rule to check for bucket encryption compliance.
- B
Create an AWS Lambda function to scan S3 buckets periodically and send a notification to an SNS topic if encryption is not enabled.
- C
Set up AWS Config with a custom rule to verify the encryption key rotation date for KMS keys used by S3 buckets.
- D
Use AWS CloudTrail to log all bucket activities and analyze the logs for encryption-related API calls.
- E
Configure an Amazon Macie job to classify sensitive data in S3 buckets and verify their encryption settings.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirement, you need to ensure encryption on S3 buckets and monitor key rotation. AWS Config's managed rules can automate the detection of non-compliant buckets with default encryption settings. Additionally, you can use AWS Config custom rules to monitor the rotation of KMS keys used for encryption, ensuring compliance with annual rotation policies. This combination provides an automated, scalable, and AWS-native solution to the problem.
- A. Correct.
Enabling S3 default encryption ensures that all new objects are encrypted, and AWS Config's managed rules can automatically detect non-compliant buckets, making it an effective and automated way to ensure compliance.
- B. Incorrect.
Although a Lambda function could be used to scan buckets and alert on non-compliance, this approach is not automated or scalable compared to AWS Config rules, which are purpose-built for compliance checks.
- C. Correct.
AWS Config custom rules can be used to verify encryption key rotation dates for KMS keys, ensuring compliance with the annual rotation requirement.
- D. Incorrect.
While AWS CloudTrail captures bucket activity, it does not directly help enforce or monitor encryption compliance. Analyzing logs would require significant custom development.
- E. Incorrect.
Amazon Macie is primarily used for data classification and identifying sensitive data, but it does not provide direct capabilities for monitoring encryption compliance.