SOA-C02 Security and Compliance Practice Question

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

⚠ Common exam trap

Candidates often choose CloudWatch Events + Lambda (Option B) thinking it provides real-time remediation, but they overlook that it only catches new buckets and fails to remediate existing noncompliant buckets or buckets that have versioning disabled after creation, whereas AWS Config provides continuous compliance monitoring and automatic remediation for both new and existing resources.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning

AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning
Why this is correct
AWS Config's s3-bucket-versioning-enabled managed rule continuously evaluates every bucket in the account, including both existing resources and newly created ones. When a bucket is found noncompliant—whether it never had versioning or had it disabled—an automatic remediation action invokes an AWS Systems Manager Automation document (such as AWS-EnableS3BucketVersioning) to enable versioning immediately. This closed-loop approach ensures ongoing compliance without manual effort, and it covers all buckets regardless of how they were created or modified. AWS Config evaluates configuration changes in near real time, making this a truly detective and corrective control.
✗
Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning
Why it's wrong here
This reactive approach only addresses buckets created after the rule is set up. It does not handle existing buckets that lack versioning, nor does it detect buckets that have versioning disabled after creation. It requires separate handling for existing resources.
✗
Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action
Why it's wrong here
AWS CloudTrail only records API activity; it does not assess whether a resource is compliant with a desired configuration. Triggering an alert on CreateBucket events and expecting the SysOps administrator to manually enable versioning introduces human latency and risk of missed remediation, so it fails the requirement for automatic action. Moreover, this approach misses buckets that were created before the monitoring was set up and, because it only watches CreateBucket, it does not detect when versioning is subsequently disabled via PutBucketVersioning on an existing bucket. Thus, it is a reactive and incomplete mechanism.
✗
Use AWS Service Catalog to enforce versioning on all buckets provisioned through it
Why it's wrong here
AWS Service Catalog enforces governance only on resources provisioned through its portfolio products, such as a product that creates an S3 bucket with versioning enabled. Any bucket created outside of Service Catalog—for example, directly via the S3 console, CLI, or SDK—bypasses those controls and would remain noncompliant. Service Catalog also lacks ongoing evaluation; after provisioning, if versioning is later disabled on a bucket, Service Catalog does not detect or remediate the change. As a result, it provides provisioning-time enforcement only and cannot serve as a comprehensive, continuous compliance solution.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SOA-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question