DOP-C02 Question 76

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  I think neither "B" or "C" is complete solution. They both need to be done to deal with both existing and new buckets. A carefull reading of the question doesn't preclude the need to do both. However, the specific and emphasized criteria of enabling encryption "as soon as the S3 buckets are created" can only be done by "C" (event driven action) I think this may be a trick question. I'm very confident they are defining an event driven action as part of the solution, and only "C" provides that. B: (NO) "Manually run the re-evaluation process to ensure that existing S3 buckets are compliant." Comment: Doesn't achieve "encryption must be enabled on new S3 buckets as soon as the S3 buckets are created."

• Chose B1

  `s3-bucket-server-side-encryption-enabled` checks if your Amazon S3 bucket either has the Amazon S3 default encryption enabled or that the Amazon S3 bucket policy explicitly denies put-object requests without server side encryption that uses AES-256 or AWS Key Management Service.

• 2

  A is correct: <implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets>: We can use lambda to configure all S3. Use Eventbridge to schedule-run lambda. B: This option uses AWS config rule to activate AWS-EnableS3BucketEncryption AWS Systems Manager Automation runbook, which is incorrect. Remember that AWS config have no action and cannot trigger anything. It only collect data and report. Additionally, this option does not mention actions to new S3 bucket C: <define the rule with an event pattern that matches the creation of new S3 buckets> means that this only affect newly-created bucket, not existing ones. D: No mention of enforcing encryption on S3 Note: Should not use chatgpt for this exam, its answers are mostly wrong