SAP-C02 Continuous Improvement for Existing Solutions Practice Question

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.

AWS Config rules can trigger custom Lambda functions to evaluate the S3 bucket policy and publish a notification to SNS if the policy allows public access. Option B is incorrect because S3 event notifications are triggered by object-level events (e.g., PUT, POST), not by policy changes. Option C is incorrect because AWS Config rules cannot directly publish to SNS; they require a Lambda function or other action to send notifications. Option D is incorrect because CloudTrail logs API calls but does not provide real-time compliance evaluation or direct notification.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.
Why this is correct
Config rules evaluate resource compliance and can invoke Lambda for remediation or notification.
✗
Configure S3 event notifications on the bucket to send events to SNS.
Why it's wrong here
S3 event notifications are for object-level events, not policy changes.
✗
Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.
Why it's wrong here
Config rules do not directly publish to SNS; they trigger Lambda or send to SQS.
✗
Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.
Why it's wrong here
CloudTrail requires additional setup and does not automatically notify.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question