A SysOps administrator must ensure that all of a company's Amazon S3 buckets have versioning enabled. Which solution will meet this requirement?

Question

Options

• AEnable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule.
• BEnable AWS Config. Set up the s3-bucket-versioning-enabled AWS Config managed rule.
• CEnable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled.
• DEnable Amazon GuardDuty. Use GuardDuty to identify S3 buckets that have versioning disabled.

• A
  3% (1)
• B
  97% (28)

Explanation

Note: Options A & B appear identical in this rendering, and C & D are also identical - the original question likely had subtle differences (e.g., option A may have lacked automatic remediation, or used a different rule name). The explanation below addresses the core concepts.

AWS Config with the s3-bucket-versioning-enabled managed rule is the correct solution because it continuously evaluates S3 bucket configurations against the rule and flags any non-compliant buckets - it can also trigger automatic remediation via AWS Systems Manager Automation to enforce versioning. The key word in the question is "ensure": AWS Config doesn't just detect, it can enforce compliance at scale across all buckets. GuardDuty (options C & D) is a threat detection service focused on identifying malicious activity and anomalies, not auditing resource configuration settings - it has no concept of "versioning enabled or not." Even if the options were identical in this rendering, GuardDuty is the wrong tool for compliance enforcement regardless of configuration.

Memory tip: Think "Config = Configuration compliance" vs. "GuardDuty = Guards against threats." Whenever an AWS exam question asks about enforcing or auditing a resource setting (versioning, encryption, public access), reach for AWS Config managed rules first.

No community discussion yet for this question.