SOA-C02 Security and Compliance Practice Question
A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?
⚠ Common exam trap
Many exam-takers confuse AWS Config's compliance evaluation with GuardDuty's threat detection or Macie's data classification, leading them to choose a service that cannot detect or remediate encryption settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config and AWS Lambda
AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config and AWS Lambda
Why this is correct
AWS Config continuously evaluates S3 buckets against the managed rule for encryption. Non-compliant buckets can trigger a remediation action via an AWS Lambda function that applies SSE-S3 configuration. This minimizes custom code and uses managed services.
- ✗
Amazon GuardDuty and AWS Lambda
Why it's wrong here
GuardDuty is a threat detection service that monitors for malicious activity, not a mechanism to enforce or apply bucket encryption policies. It cannot automatically enable SSE-S3 on non-compliant buckets. This option is tempting because GuardDuty can detect unusual S3 access patterns, and in a scenario requiring security monitoring or anomaly alerting, it would be the correct choice. However, the stem demands automatic remediation of encryption settings, which GuardDuty lacks the capability to perform.
- ✗
AWS CloudTrail and Amazon EventBridge
Why it's wrong here
CloudTrail logs API events, and EventBridge can trigger on those events. However, this would only react to bucket creation or modification events, not proactively detect existing buckets without encryption, and would require custom code to compare state.
- ✗
Amazon Macie and AWS Step Functions
Why it's wrong here
Amazon Macie is a data security service that uses machine learning and pattern matching to discover and protect sensitive data in S3 buckets; it has no capability to evaluate or enforce a bucket's default encryption setting. AWS Step Functions is a workflow orchestration service that could coordinate Lambda functions, but adding it here introduces needless state-machine complexity compared to the native remediation action available through AWS Config. Since Macie cannot determine whether SSE-S3 is enabled and Step Functions only adds overhead, this pair fails to meet the requirement of automatically detecting and correcting unencrypted buckets.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.