SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).

  Why this is correct

  This uses AWS Config for detection and Lambda for remediation, which is a standard pattern. Bucket policy approach prevents future unencrypted uploads but does not encrypt existing objects; however, the requirement is to apply encryption configuration, which can be done via put-bucket-encryption API. The Lambda can call that API. This is a valid solution with managed services and minimal custom code (only the Lambda).

• ✗

  Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.

  Why it's wrong here

  There is no S3 account-level default encryption setting in the S3 console or via any S3 API. Default encryption (SSE-S3 or SSE-KMS) is a bucket-level configuration that must be explicitly applied to each bucket individually. While AWS Organizations or other account management services can help standardize configurations, S3 itself does not offer an account-wide toggle that automatically applies SSE-KMS to all new buckets. This option is not technically feasible and would leave existing buckets permanently non-compliant.

• ✗

  Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.

  Why it's wrong here

  This option is flawed because AWS Config primarily detects and reports non-compliance; it does not directly apply encryption. While Config can trigger remediation via a Lambda function or Systems Manager Automation, the option implies Config itself applies the encryption, which is incorrect. CloudTrail and Lambda can handle new bucket creation events, but this combination still requires custom code for the encryption check and application. This approach is tempting as Config is excellent for compliance auditing and reporting, and CloudTrail with Lambda is a standard event-driven pattern for custom automation.

• ✗

  Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.

  Why it's wrong here

  SCP can prevent creation of buckets without encryption but does not remediate existing buckets. The requirement includes detecting and remediating both existing and new buckets. This solution only addresses new buckets and does not automatically apply encryption to existing ones.

Go deeper

Related to this question