SOA-C02 Practice Question: AWS Config rule with automatic SSM remediation…
The security team requires that no S3 bucket in the account ever has public read or write ACLs enabled. They want non-compliant buckets automatically remediated within 5 minutes of detection without any manual intervention. What is the correct implementation?
⚠ Common exam trap
Test-takers frequently choose Option C (Block Public Access) thinking it prevents all public access, but it does not remediate existing non-compliant buckets, which is explicitly required by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document
AWS Config can evaluate S3 bucket ACLs against the `s3-bucket-public-read-prohibited` managed rule and automatically trigger an AWS Systems Manager (SSM) Automation document (`AWS-DisableS3BucketPublicReadWrite`) as a remediation action. This ensures non-compliant buckets are fixed within minutes without manual intervention, meeting the 5-minute requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an AWS Config rule for s3-bucket-public-read-prohibited; configure auto-remediation using the AWS-DisableS3BucketPublicReadWrite SSM Automation document
Why this is correct
Config evaluates the rule within seconds of a bucket ACL change. The auto-remediation action invokes the SSM document automatically when compliance status changes to NON_COMPLIANT. The SSM document calls PutBucketAcl to remove public grants. The entire cycle completes in 1-3 minutes under normal conditions.
- ✗
Create an EventBridge rule that matches S3 PutBucketAcl API calls and triggers a Lambda function to re-apply a private ACL
Why it's wrong here
An EventBridge rule matching `PutBucketAcl` API calls will only trigger remediation when an ACL is explicitly set via that API call, but S3 buckets can also be made public through bucket policies or by enabling ACLs via the S3 console's "public access" settings, which do not invoke `PutBucketAcl`. This option is tempting because EventBridge and Lambda are the standard pattern for reacting to API calls in real time, and would be correct if the requirement were to remediate only ACL changes made through the `PutBucketAcl` API, not all mechanisms that grant public access.
- ✗
Enable S3 Block Public Access at the account level to prevent public ACLs from being set in the first place
Why it's wrong here
S3 Block Public Access is a preventive control that blocks future public ACL settings — it is the correct long-term solution and should also be implemented. However, it does not detect or remediate buckets that were already public before the setting was enabled, so the Config auto-remediation is still needed for non-compliant existing resources.
- ✗
Schedule a daily Lambda function that lists all buckets, checks ACLs, and removes public grants if found
Why it's wrong here
A daily schedule means a bucket can remain public for up to 24 hours before remediation. The requirement is 5 minutes. Config with auto-remediation triggers on configuration change, not on a schedule, making it far more responsive.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.