DOP-C02 Security and Compliance Practice Question
A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.
Options B, D, and E are correct. An SCP can centrally deny s3:PutBucketAcl actions that make buckets public, preventing public access across all accounts (B). AWS Config with the managed rule 's3-bucket-public-read-prohibited' can detect publicly accessible buckets across accounts when using an aggregator (D). CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function to automatically remediate non-compliant buckets, such as applying a bucket policy or ACL change (E). Option A (Trusted Advisor) is per-account and only alerts, not remediates; Option C (manual review) is not scalable for multiple accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Trusted Advisor to check for open S3 buckets and send alerts.
Why it's wrong here
AWS Trusted Advisor's S3 Bucket Permissions check is a read-only audit that flags buckets with public read/write access, but the service has no native remediation action. It sends notifications via CloudWatch Events or weekly emails, yet you would still need a separate custom Lambda or manual process to fix the policy, so it only fulfills the detect part of the requirement, not the remediate part.
- ✓
Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.
Why this is correct
An SCP attached at the AWS Organizations root or an OU can deny the specific IAM actions that grant public access, such as s3:PutBucketAcl with a condition like s3:x-amz-acl=public-read or s3:PutBucketPolicy. Because SCPs act as a governance boundary across all accounts in the organization, they proactively prevent a bucket from ever becoming public, but they do not remediate existing buckets that are already public, so this is a preventive, not detective, control.
- ✗
Manually review each account's S3 bucket permissions weekly.
Why it's wrong here
A weekly manual review of S3 bucket permissions across multiple accounts and regions is neither timely nor comprehensive; a bucket could be made public minutes after the review and remain exposed for up to seven days. Manual audits are error-prone because they rely on visual inspection of JSON policies and ACLs, and they cannot scale to hundreds or thousands of buckets, making this an impractical detective control for a security team requiring automated detection and remediation.
- ✓
Use AWS Config with a managed rule to detect publicly accessible S3 buckets.
Why this is correct
AWS Config's managed rule s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited continuously evaluate whether any bucket in the account or region has public access. Config records non-compliant resources and can integrate with Systems Manager Automation or EventBridge to trigger remediation, and with an aggregator it can evaluate resources across multiple accounts and regions, satisfying the detection requirement and feeding the remediation workflow.
- ✓
Use Amazon CloudWatch Events to trigger a Lambda function that remediates non-compliant buckets.
Why this is correct
Amazon EventBridge (formerly CloudWatch Events) can detect AWS API calls like PutBucketPolicy or PutBucketAcl via CloudTrail and invoke a Lambda function that automatically removes the public grant or reapplies a compliant bucket policy. This is a reactive, event-driven remediation pattern that scales across all buckets and accounts, fixing the non-compliant bucket within seconds, but it does not prevent the action from happening in the first place, so it is a detective/remediative control that should complement an SCP.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.