SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.

  Why it's wrong here

  This option fails because AWS Config's automatic remediation actions directly invoke AWS Systems Manager Automation documents or AWS Lambda functions when non-compliance is detected. It does not trigger an Amazon CloudWatch alarm as an intermediary step for automatic remediation; CloudWatch alarms are primarily for monitoring and alerting. The option is tempting because `rds-instance-encrypted` and `rds-backup-enabled` are relevant Config rules, and Lambda functions are indeed used for custom remediation logic. CloudWatch alarms can also invoke Lambda for other reactive automation scenarios, but not as part of Config's direct remediation workflow.

• ✗

  Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.

  Why it's wrong here

  Custom AWS Config rules implemented as Lambda functions are unnecessary here because AWS already provides managed rules for both requirements. More critically, the Lambda approach cannot work for the encryption requirement: RDS encryption at rest is enabled only at instance creation time, and the RDS ModifyDBInstance API does not support turning encryption on for an existing unencrypted instance. To remediate non-compliance, you would have to snapshot the instance, create an encrypted copy of that snapshot, and restore it as a new DB instance—a process not captured by a simple API call inside the Lambda function. You should instead use Config managed rules with SSM Automation remediation runbooks.

• ✓

  Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.

  Why this is correct

  This is the correct approach. Managed rules evaluate compliance, and automatic remediation using Systems Manager Automation runbooks applies the fix without custom code. The runbooks perform the necessary API calls to enable encryption and backups, meeting the policy requirements.

• ✗

  Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.

  Why it's wrong here

  A custom AWS Config rule with a Lambda function cannot remediate the encryption requirement for an existing Amazon RDS instance because encryption at rest is configured during instance creation and cannot be modified afterwards; an unencrypted instance would need to be recreated from an encrypted snapshot. This option is tempting as custom rules with Lambda functions are powerful for complex, bespoke compliance checks and remediation actions, such as adjusting backup retention periods or other modifiable instance parameters, where the AWS API supports direct modification of existing resources.

Go deeper

Related to this question