DOP-C02 · Question #91
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without…
The correct answer is B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule. B caters to both existing and new buckets. C is triggered on when new bucket is created, existing buckets are not handled by the event.
Question
A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted. A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256). Which solution will meet these requirements?
Options
- ACreate an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled
- BSet up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule.
- CCreate an AWS Lambda function that is invoked by an Amazon EventBridge event rule. Define the
- DConfigure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption
How the community answered
(36 responses)- A3% (1)
- B81% (29)
- C6% (2)
- D11% (4)
Explanation
B caters to both existing and new buckets. C is triggered on when new bucket is created, existing buckets are not handled by the event.
Topics
Community Discussion
No community discussion yet for this question.