SOA-C02 Security and Compliance Practice Question
A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are configured with server-side encryption using AWS KMS (SSE-KMS). The administrator wants to automatically detect any S3 buckets that are not compliant and remediate them by enabling SSE-KMS. Which AWS service should be used to implement this automated compliance enforcement?
⚠ Common exam trap
Test-takers frequently confuse AWS Config's reactive compliance monitoring with Trusted Advisor's advisory checks, or assume CloudFormation can handle post-deployment compliance, but only AWS Config provides the continuous evaluation and automated remediation required for this use case.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 buckets for compliance with SSE-KMS. When a non-compliant bucket is detected, AWS Config can trigger an AWS Systems Manager Automation document or a custom remediation action (via AWS Config Rules remediation) to automatically enable SSE-KMS on the bucket, ensuring automated enforcement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config continuously evaluates S3 bucket configurations against managed rules such as s3-bucket-server-side-encryption-enabled, which specifically verifies that default encryption is set to SSE-KMS. When a bucket is non-compliant, AWS Config can automatically invoke an SSM automation document (e.g., AWS-EnableS3BucketEncryption) to remediate the violation, enforcing SSE-KMS without manual intervention. This real-time monitoring and automated remediation capability is exactly what the SysOps administrator needs to ensure all S3 buckets meet the encryption requirement.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor offers a security check for S3 bucket encryption as part of its recommendations, but it is purely advisory and provides no built-in remediation actions. It periodically refreshes checks, yet it does not evaluate every configuration change in real time nor does it trigger any automated fixes. Therefore, while it can identify non-compliant buckets for manual review, it cannot enforce or automatically apply SSE-KMS encryption across existing resources, making it unsuitable for the stated requirement.
- ✗
AWS Service Catalog
Why it's wrong here
AWS Service Catalog is designed to create and manage portfolios of approved IT services, enabling users to provision predefined products such as S3 buckets with built-in templates. It does not monitor the configuration of already existing, independently created resources, nor does it have any mechanism to detect or remediate non-compliant buckets. Since the requirement is to enforce encryption on current S3 buckets, Service Catalog is irrelevant because it only governs the initial provisioning of future resources, not ongoing compliance.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code service that deploys resources from templates, but it does not continuously assess S3 buckets for encryption compliance after they are created. Although CloudFormation supports drift detection, this feature only identifies changes made to stack-managed resources and requires manual intervention or a separate custom solution to fix them—it does not auto-remediate. Moreover, existing S3 buckets that were not created via a CloudFormation stack fall completely outside its visibility, leaving the administrator without any automated enforcement of SSE-KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.