SOA-C02 Security and Compliance Practice Question
A company's security team requires that all Amazon S3 buckets are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any S3 bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?
⚠ Common exam trap
Test-takers frequently confuse enforcing encryption on object uploads (via bucket policies or CloudTrail/Lambda) with ensuring the bucket's default encryption setting is enabled, which is what AWS Config's managed rule and remediation specifically address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' with an automatic remediation action using AWS Systems Manager Automation.
AWS Config's managed rule 's3-bucket-server-side-encryption-enabled' continuously evaluates S3 buckets for encryption compliance, and its automatic remediation action can invoke an AWS Systems Manager Automation document to enable SSE-S3 encryption on noncompliant buckets without custom code. This fully meets the requirement to automatically detect and remediate unencrypted buckets using AWS managed services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Trusted Advisor to identify unencrypted buckets and then manually enable encryption.
Why it's wrong here
The AWS Trusted Advisor S3 bucket encryption check identifies which buckets do not have default server-side encryption enabled, yet it is purely an advisory tool with no built-in automation. Correcting the listed findings requires a user to manually access the console or run separate SDK scripts to enable the bucket encryption setting on each non-compliant bucket. Because the company requires that all S3 buckets be encrypted and presumably wants continuous enforcement, using Trusted Advisor alone leaves human intervention in the loop and does not remediate future misconfigurations automatically.
- ✓
Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' with an automatic remediation action using AWS Systems Manager Automation.
Why this is correct
The AWS Config managed rule 's3-bucket-server-side-encryption-enabled' continuously evaluates whether S3 buckets have default encryption such as SSE-S3, SSE-KMS, or DSSE-KMS configured. When a bucket is marked NON_COMPLIANT during either a configuration change or a periodic evaluation, AWS Config can invoke an AWS Systems Manager Automation document, specifically the AWS-EnableS3BucketEncryption runbook, to automatically update the bucket's encryption setting and immediately reevaluate it. This approach provides a closed-loop, automated remediation workflow that satisfies the security team's requirement without custom code or manual intervention.
- ✗
Use AWS CloudTrail to detect PutBucket operations and trigger a Lambda function that enables encryption.
Why it's wrong here
AWS CloudTrail records API activity, but its main purpose is auditing who made the PutBucketEncryption or CreateBucket calls, not inspecting the current state of every existing bucket. Wiring a Lambda function to CloudTrail would only execute after a qualifying API event occurs, meaning legacy buckets that never had an encryption event are never evaluated. Also, this would require building and maintaining a custom Lambda policy for each event and does not provide a native, rule-based compliance evaluation that AWS Config offers.
- ✗
Create an IAM bucket policy that denies any PutObject request that does not include x-amz-server-side-encryption header.
Why it's wrong here
An IAM bucket policy with a Deny condition on PutObject requests lacking the x-amz-server-side-encryption header ensures that new objects are uploaded with encryption, but it does nothing to require or set the bucket's default encryption configuration. The policy does not detect or remediate the preexisting bucket setting that the security team specifically wants enabled, and it fails to address scenarios like the bucket default encryption being off. This is a preventive control for object uploads, not a compliance check for the bucket requirement itself.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.