Question 1,342 of 418
Automated Remediation of Public S3 Buckets with AWS Config and Systems Manager Automation
A DevOps team needs to implement a solution to automatically remediate an S3 bucket that becomes publicly accessible. Which TWO services should they use together?
Quick Answer
The answer is AWS Config and AWS Systems Manager Automation. AWS Config continuously monitors S3 bucket configurations against managed rules like s3-bucket-public-read-prohibited, and when a bucket becomes publicly accessible, it triggers an automation document in Systems Manager Automation to remediate the issue—for example, by applying a bucket policy that blocks all public access. This combination is correct because it provides a fully automated, event-driven remediation pipeline without requiring custom Lambda code, directly addressing the need to automatically remediate public S3 buckets. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this pairing tests your understanding of AWS Config’s integration with Systems Manager Automation as a native remediation action, a common trap being to mistakenly choose Lambda alone—but the question specifically asks for two services, and Systems Manager Automation handles the remediation logic without additional compute. Memory tip: think “Config catches, Automation patches”—the rule detects the violation, and the automation document fixes it.
⚠ Common exam trap
AWS often tests the misconception that AWS Lambda is the primary service for custom remediation. However, AWS Config natively integrates with AWS Systems Manager Automation for automatic remediation of non-compliant resources, reducing the need for custom Lambda functions. Lambda is not listed as a correct answer in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config can monitor S3 bucket configurations using a managed rule such as s3-bucket-public-read-prohibited. When a violation is detected, Config can automatically invoke an AWS Systems Manager Automation document as a remediation action. Systems Manager Automation runs a pre-defined workflow (e.g., applying a bucket policy that blocks public access) to correct the issue. This combination provides automated, event-driven remediation without manual intervention, making AWS Config and AWS Systems Manager Automation the correct pair.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail logs API calls, not configuration compliance.
- ✓
AWS Config
Why this is correct
Config can evaluate bucket policies and trigger remediation.
- ✗
AWS Lambda
Why it's wrong here
Lambda is possible but Config's auto-remediation is the recommended approach.
- ✓
AWS Systems Manager Automation
Why this is correct
Automation runbooks can remediate the public access.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty detects threats, not configuration issues.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Match each AWS automation or configuration management tool to its description.
medium- ✓ A.AWS CloudFormation: Infrastructure as Code service using templates to provision AWS resources.
- ✓ B.AWS OpsWorks: Configuration management service using Chef and Puppet to automate server configuration.
- ✓ C.AWS Elastic Beanstalk: Platform as a Service (PaaS) for deploying and scaling web applications.
- ✓ D.AWS CodeDeploy: Automated deployment service for deploying code to any instance.
- E.AWS CloudFormation: Automated code deployment service.
- F.AWS OpsWorks: Platform as a Service for web applications.
Why A: AWS CloudFormation is for IaC, OpsWorks for configuration management, Elastic Beanstalk for PaaS, and CodeDeploy for automated deployments. Distractors swap definitions.
Last reviewed: Jun 30, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.