A corporation is preparing to acquire several companies. A Security Engineer must design a solution to ensure that newly acquired AWS accounts follow the corporation's security best practices. The sol

The correct answer is C. Set up AWS Systems Manager to monitor S3 bucket policies for public write access.. Note: The marked answer (C) appears to be incorrect. The actual correct answer is B - AWS Config. AWS Config is the right choice because it is a fully managed AWS service with a built-in managed rule (s3-bucket-public-write-prohibited) that continuously evaluates S3 bucket config

Submitted by tom_us· Mar 6, 2026Management and Security Governance

Question

A corporation is preparing to acquire several companies. A Security Engineer must design a solution to ensure that newly acquired AWS accounts follow the corporation's security best practices. The solution should monitor each Amazon S3 bucket for unrestricted public write access and use AWS managed services. What should the Security Engineer do to meet these requirements?

Options

AConfigure Amazon Macie to continuously check the configuration of all S3 buckets.
BEnable AWS Config to check the configuration of each S3 bucket.
CSet up AWS Systems Manager to monitor S3 bucket policies for public write access.
DConfigure an Amazon EC2 instance to have an IAM role and a cron job that checks the status of

How the community answered

(35 responses)

A
3% (1)
B
9% (3)
C
74% (26)
D
14% (5)

Explanation

Note: The marked answer (C) appears to be incorrect. The actual correct answer is B - AWS Config.

AWS Config is the right choice because it is a fully managed AWS service with a built-in managed rule (s3-bucket-public-write-prohibited) that continuously evaluates S3 bucket configurations against that specific policy requirement. It integrates with AWS Organizations, making it ideal for rolling out consistent security checks across newly acquired accounts at scale.

Why the other options are wrong:

A (Amazon Macie) focuses on discovering and classifying sensitive data (PII, financial records) within S3 objects - it does not evaluate bucket-level access control configurations like public write permissions.
C (AWS Systems Manager) is designed for managing EC2 instances and on-premises servers (patching, run commands, session management). It has no native capability to audit S3 bucket policies for public access.
D (EC2 + cron job) is a custom, self-managed solution, which directly violates the "AWS managed services" requirement.

Memory tip: Think "Config = Configuration compliance." Whenever an exam question asks about continuously checking or auditing the configuration state of AWS resources against rules, AWS Config is almost always the answer. Macie = sensitive data discovery, not configuration checks.

If this question came from a practice exam or study guide, the answer key likely has a typo - flag it and remember that B is correct on the real exam.

Topics

#AWS Systems Manager#S3 Bucket Security#Configuration Compliance#Security Best Practices

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice