DOP-C02 Security and Compliance Practice Question
A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?
⚠ Common exam trap
DOP-C02 often tests the difference between detection and remediation — candidates pick Security Hub or Macie because they 'monitor' security, but only Config has native auto-remediation via SSM Automation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config continuously records resource configuration changes and evaluates them against Config rules, including the managed rule `s3-bucket-public-read-prohibited` and `s3-bucket-public-write-prohibited`. When a bucket becomes non-compliant, Config can trigger an SSM Automation document (via a remediation action) to automatically block public access, making it the service that both monitors and remediates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config is the correct service because it offers managed rules specifically for detecting S3 public access, such as s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited. These rules can be evaluated continuously, and when a violation is found, AWS Config can automatically invoke remediation actions through SSM automation documents, such as removing the public policy. This provides a continuous, automated enforcement mechanism that goes beyond simple detection, making it the only listed service capable of enforcing the requirement.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie is incorrect because its primary purpose is to discover and protect sensitive data using machine learning, not to enforce S3 bucket public access policies. While it can monitor for unusual access patterns, it cannot evaluate bucket ACLs or bucket policies to determine whether a bucket is publicly accessible, nor does it have any remediation actions to alter bucket settings. Enforcement of public access controls requires a service that can evaluate configurations and trigger corrective actions, which Macie lacks.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub is wrong for this use case because it is a security posture management service that aggregates findings from multiple AWS services, including AWS Config, into a consolidated dashboard. It does not inherently evaluate S3 bucket permissions or enforce public access rules on its own; rather, it collects and displays compliance statuses from services like Config. While Security Hub can send findings to EventBridge to trigger custom remediation, that requires additional setup and is not its native capability, so it does not enforce public access directly.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is not suitable because it offers only periodic, advisory checks, such as the S3 bucket public read/write checks, but it never performs automated remediation or enforcement. Its role is to provide recommendations for cost optimization, security, and performance, and any corrective action must be manually performed by the user. Moreover, Trusted Advisor checks are run on a limited schedule and do not provide real-time continuous enforcement, making it inadequate for a policy that requires S3 buckets to not be publicly accessible.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.