Review answers

1. S3 Standard.
2. Make sure that an IAM group has been created just for members of the accounting department. Create an IAM (user-based) policy that allows members of the accounting group to have full permissions on the accounting bucket. You could go a step further and create a policy boundary that explicitly denies access to the accounting bucket and place that on all other groups.
3. Create an S3 inventory report. Use AWS Athena to query for files that are not encrypted.