SAP-C02 Q173 · Security

Question

A company needs to audit the security posture of a newly acquired AWS account. The company’s data security team requires a notification only when an Amazon S3 bucket becomes publicly exposed. The company has already established an Amazon Simple Notification Service (Amazon SNS) topic that has the data security team's email address subscribed. Which solution will meet these requirements?

Accepted Answer

**Option B: IAM Access Analyzer + EventBridge + SNS**

**Step-by-step how this satisfies every requirement:**

1. **Audit security posture of S3 buckets**: IAM Access Analyzer continuously analyzes resource-based policies (including S3 bucket policies and ACLs) to determine if resources are accessible from outside the account's zone of trust (the AWS account or organization).

2. **Notification only when a bucket becomes publicly exposed**: Access Analyzer generates a **finding** when it detects a resource is publicly accessible. The finding includes an `isPublic` field set to `true`. By creating an EventBridge rule that filters specifically for `"isPublic": true`, the notification fires **only** for public exposure — not for cross-account access or other finding types.

3. **Send notifica

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips