SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Lambda with S3 events

  Why it's wrong here

  AWS Lambda with S3 events is incorrect because S3 event notifications are emitted only for object-level operations such as s3:ObjectCreated:* or s3:ObjectRemoved:* — they are never triggered by bucket-configuration calls like PutBucketEncryption. To detect and fix existing unencrypted buckets, you would need custom logic and a separate trigger (e.g., a Config rule or CloudTrail event), plus a bespoke remediation function. AWS Config, by contrast, gives you a fully managed rule with automatic remediation through Systems Manager Automation, so this option is wrong.

• ✓

  AWS Config with managed rules and auto-remediation

  Why this is correct

  The correct solution is AWS Config with a managed rule such as s3-bucket-server-side-encryption-enabled, which continuously evaluates whether each bucket has default encryption enabled. When a bucket is noncompliant, AWS Config can invoke auto-remediation using an SSM Automation document like AWS-EnableS3BucketEncryption to apply SSE-S3 or SSE-KMS. This provides both detection and automated correction, unlike event-driven or logging-only approaches.

• ✗

  AWS IAM policy to deny PutBucketEncryption without encryption

  Why it's wrong here

  An IAM policy cannot remediate existing unencrypted buckets because IAM condition keys are evaluated against the attributes of the incoming API request, not against the current resource configuration. While you can use s3:x-amz-server-side-encryption on s3:PutObject to require encrypted writes, denying PutBucketEncryption would simply block the API that actually enables default bucket encryption. Existing buckets that are already unencrypted would remain unencrypted until a remediation action executes, so this is not a complete enforcement solution.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail is fundamentally a detective control: it records and logs API calls such as PutBucketEncryption and can trigger CloudWatch Events when noncompliant activity occurs. It does not evaluate the compliance state of resources, and it cannot automatically alter a bucket's encryption configuration. Even with a Lambda rule on CloudTrail events, you'd be building the exact custom remediation you'd otherwise get for free with AWS Config auto-remediation.

Go deeper

Related to this question