SOA-C02 Security and Compliance Practice Question
A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?
⚠ Common exam trap
Many exam-takers confuse detection-only services (like Trusted Advisor or CloudTrail) with services that can both detect and automatically remediate, or they mistakenly think Macie handles encryption compliance when it actually focuses on data classification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.
AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.
Why this is correct
AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates whether every S3 bucket has default encryption configured. When a bucket is found non-compliant, Config's automatic remediation feature can invoke an AWS Systems Manager Automation document (e.g., AWS-EnableS3BucketEncryption) to apply SSE-KMS to that bucket. Because Config is state-based, it detects both pre-existing non-compliant buckets and buckets that drift after creation. With AWS Organizations, you can deploy the rule and remediation across all accounts using CloudFormation StackSets, and aggregators centralize compliance visibility.
- ✗
AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.
Why it's wrong here
CloudTrail logs API calls but does not evaluate the current state of resources. A metric filter could detect PutBucketEncryption events, but it would not catch buckets that were already non-compliant before the rule was set up. This approach is event-driven and not state-based, and it cannot cover existing buckets across all accounts easily.
- ✗
AWS Trusted Advisor to check S3 bucket encryption and send notifications.
Why it's wrong here
AWS Trusted Advisor offers a security check for S3 bucket encryption under its 'S3 Bucket Server-Side Encryption Enabled' category, but it is fundamentally a read-only assessment tool. It can notify you via weekly email reports or CloudWatch alarms, yet it provides no mechanism to modify the bucket configuration or automatically apply encryption. Moreover, Trusted Advisor checks are not natively aggregated across all accounts in an AWS Organization; you would need to separately access or collect results per account, and it does not support compliance-based remediation workflows the way AWS Config does.
- ✗
Amazon Macie to discover sensitive data and then manually encrypt buckets.
Why it's wrong here
Amazon Macie is designed for data security and data privacy, using machine learning to discover sensitive data such as PII, credentials, or proprietary information in S3 buckets. It does not evaluate or enforce bucket-level encryption settings; a bucket with sensitive content but no default encryption would not be flagged by Macie for encryption non-compliance. Manual encryption of buckets after Macie discovery is a potential operational step, but it is not automated, does not scale across multiple accounts, and leaves the core requirement of continuous, state-based compliance enforcement unmet.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.