DOP-C02 practice question: AWS Config rules and automatic remediation (1 of 2)
Incident and Event Response A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional bank keeps customer statement exports in Amazon S3 buckets across 25 accounts. An AWS Config rule checks whether each bucket blocks public access, and the bank wants any bucket that becomes non-compliant to be fixed automatically.
Remediation must be performed by a role that can change only the public-access settings of the bucket, and the fix should be retried a few times if a change fails because of a temporary error. The security team also needs to see each remediation attempt in the Config console.
The team wants the remediation to use an AWS-managed runbook rather than custom code.
Which configuration meets these requirements?
Choose one answer.
AA. Turn on the Config rule in each account and leave it in evaluation-only mode, so that the security team reviews the noncompliant buckets each day and fixes them by hand.
BB. Create an EventBridge rule for CloudTrail PutBucketPublicAccessBlock events that invokes a Lambda function, which removes any public access it finds on the bucket.
CC. Add a service control policy to each account that denies any change to S3 bucket public-access settings, so that buckets cannot become public in the first place.
DD. Attach automatic remediation to the Config rule that runs an AWS Systems Manager Automation document to block public access, with a retry count and a scoped remediation role.
AWS Config remediation can run a Systems Manager Automation runbook automatically for each non-compliant resource, with retry attempts and a remediation role. Results appear with the rule in the Config console. Evaluation-only rules, custom functions and preventive policies each miss the automatic fix, the scoped role or the visibility the bank wants.
Want more on AWS Config rules and automatic remediation? The 5 full-length practice sets have 9 more AWS Config rules and automatic remediation questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →