SOA-C02 Security and Compliance Practice Question
A company wants to ensure that all Amazon S3 buckets have versioning enabled to protect against accidental deletion of objects. A SysOps administrator needs to automatically detect any buckets that do not have versioning enabled and receive notifications. Which AWS service should the administrator use?
⚠ Common exam trap
Candidates often confuse AWS Config (continuous configuration auditing) with AWS CloudTrail (API activity logging), thinking that CloudTrail can detect non-compliant states when it only records actions that change the state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides managed rules, such as 's3-bucket-versioning-enabled', that continuously evaluate your S3 buckets against desired configuration states. When a bucket is non-compliant (versioning disabled), AWS Config can trigger an Amazon SNS notification to alert the administrator, enabling automated detection and remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records every API call made in your account, including PutBucketVersioning, but it does not retain or expose the resulting configuration state of an S3 bucket. To determine whether versioning is currently enabled, you would need to manually query the logs and track the most recent event, which is not a real-time or automated compliance check. CloudTrail is designed for auditing API activity and user behavior, not for evaluating resource configurations against desired policies.
- ✓
AWS Config
Why this is correct
AWS Config continuously records resource configuration changes and evaluates them against desired policies using managed or custom rules. The managed rule 's3-bucket-versioning-enabled' specifically checks whether an S3 bucket has versioning turned on, and AWS Config will flag the bucket as noncompliant if it is disabled. It also integrates with Amazon SNS for real-time notifications and AWS Systems Manager Automation for automatic remediation, making it the appropriate service for proactive compliance enforcement.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that automatically discovers and scans compute workloads, such as EC2 instances, container images in ECR, and Lambda functions, for software vulnerabilities or unintended network exposure. It does not interact with or assess the configuration of storage services like Amazon S3. Therefore, Inspector cannot detect whether a bucket has versioning enabled, as that is a data plane configuration outside its scope.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor provides a limited set of pre-defined best-practice checks, and while it includes an S3 bucket permissions check for public access, it does not include a check for bucket versioning. Trusted Advisor also does not support custom rules, real-time notifications, or automated remediation, and its checks are refreshed periodically rather than continuously. This makes it unsuitable for ensuring ongoing compliance with a specific internal policy like versioning enabled on all S3 buckets.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.