ANS-C01 Network Security, Compliance and Governance Practice Question
A financial services company has a multi-account AWS environment managed via AWS Organizations. The security team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key (CMK) from the security account. Currently, some accounts have S3 buckets with SSE-S3 encryption or no encryption. The security team must not be able to read the data in the buckets, but must be able to detect and remediate non-compliant buckets. The solution must use AWS native services and minimize operational overhead. Which combination of actions should the security team take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.
AWS Config organization conformance packs allow centralized definition of a custom rule to check S3 bucket encryption settings across all accounts. Automatic remediation via Systems Manager Automation can apply the required KMS key to non-compliant buckets without granting the security team data access. Option A is incorrect because it requires per-account AWS Config setup and custom Lambda rules, increasing operational overhead and lacking centralized enforcement. Option B is incorrect because SCPs cannot enforce encryption settings on existing buckets and only apply to IAM principals, not to S3 service actions like bucket configuration; they also cannot detect or remediate non-compliant configurations. Option D is incorrect because CloudTrail trails only log API calls and cannot proactively detect existing bucket encryption settings; metric filters are reactive and not suitable for continuous compliance monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS Config in each member account individually and create a custom rule using AWS Lambda to check bucket encryption, then send compliance results to the security account via Amazon EventBridge.
Why it's wrong here
While this could work, it requires manual setup in each account and is less centralized than using organization conformance packs, leading to operational overhead.
- ✗
Use a service control policy (SCP) to deny s3:PutObject unless the request includes a specific KMS key ID.
Why it's wrong here
SCPs can deny API calls, but they cannot enforce existing buckets that are already non-compliant, and the security team cannot detect non-compliant buckets without additional services.
- ✓
Create an AWS Config rule in the security account with an organization conformance pack to check bucket encryption settings, and use an automatic remediation action with AWS Systems Manager Automation to apply the required KMS key.
Why this is correct
This solution uses AWS Config rules to continuously evaluate compliance, and automatic remediation ensures non-compliant buckets are fixed. The security team can view compliance status without data access.
- ✗
Enable AWS CloudTrail in the security account and create a metric filter to detect PutBucketEncryption API calls, then trigger a Lambda function to remediate.
Why it's wrong here
This approach only detects changes after they happen, does not enforce a baseline, and does not cover existing buckets.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.