SAP-C02 Practice Question 88: Config Auto Remediation SSM Automation

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 9 · question 8 of 10

Continuous Improvementeasy

A company's security policy says that no Amazon S3 bucket may allow public access. AWS Config already flags buckets that violate this policy with a managed rule, but engineers fix the findings by hand, sometimes days later. The company wants noncompliant buckets to be corrected automatically as soon as they are detected, by using AWS-managed actions and with as little custom code as possible.

Which solution meets these requirements?

Show answer and explanation

Answer:

D. Configure automatic remediation on the AWS Config rule by using an AWS Systems Manager Automation document

*"AWS Config allows you to remediate noncompliant resources that are evaluated by AWS Config Rules. AWS Config applies remediation using AWS Systems Manager Automation documents."* AWS *"provides a set of managed automation documents with remediation actions"*, and you can set up manual or automatic remediation. Associating a managed automation document with the rule corrects a bucket as soon as it is evaluated as noncompliant, with no custom code (option D).

- A is wrong because a nightly custom function reacts up to a day late and has to be written and maintained. - B is wrong because it keeps the manual, delayed process that the company wants to eliminate. - C is wrong because denying PutBucketPolicy for everyone does not fix existing public buckets, and it blocks legitimate policy changes.

Reference: Remediating Noncompliant Resources with AWS Config

Practice Test 9 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.