AWS SAP-C02 · Question 56 · Domain 3.2: Security Improvement
A company has a strict security policy that all Amazon S3 buckets must be encrypted with AWS KMS. They have hundreds of existing buckets across multiple accounts. The security team wants to automatically remediate any bucket that is created without KMS encryption, or any existing bucket that has encryption disabled. What is the MOST scalable and automated way to achieve this?
Answer options:
Create an EventBridge rule to trigger a Lambda function on the CreateBucket API call.
Deploy an AWS Config rule with an automatic remediation action using an SSM Automation document.
Use AWS CloudTrail to search for unencrypted buckets and manually run a script.
Create an SCP that denies s3:PutObject if the encryption header is missing.
75 questions · hints · full answers · grading
Expert