SOA-C02 Security and Compliance Practice Question
A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?
⚠ Common exam trap
Candidates often confuse AWS Config's detective and remediation capabilities with CloudTrail's logging or Trusted Advisor's advisory-only checks, assuming any 'security' service can enforce compliance, but only AWS Config provides automated remediation via rules and Systems Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config can continuously monitor and evaluate S3 bucket configurations. With a managed rule for server-side encryption, it can detect non-compliant buckets. Combined with automatic remediation actions, AWS Config can enable encryption on non-compliant buckets without manual intervention.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity by capturing event history for governance and audit purposes, but it does not inspect the state of S3 bucket configurations or enforce encryption. It can log when a PutBucketEncryption call is made, but it cannot compare existing buckets against a desired policy or trigger automatic corrective actions. For encryption compliance, CloudTrail is merely an auditing log, not a detective or remediative control.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous security monitoring service that uses machine learning to identify suspicious behavior such as credential compromise or cryptocurrency mining, based on DNS queries, VPC Flow Logs, and CloudTrail management events. It neither evaluates bucket-level encryption settings nor understands compliance requirements, and it lacks the ability to remediate configuration drift. Therefore, it cannot ensure S3 buckets have server-side encryption enabled.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects AWS environments and offers recommendations for cost optimization, performance, fault tolerance, and security, including checks on S3 bucket permissions; however, it has no check for server-side encryption and cannot automatically modify any resource. Its guidance requires manual intervention to act upon, and it is designed to advise rather than enforce compliance. Thus, it cannot guarantee that all S3 buckets are encrypted.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.