SCS-C02 Question 481
Select 2Your organization has implemented AWS Config to monitor and evaluate the configurations of AWS resources. You need to ensure that any changes to configurations violating compliance rules trigger notifications to the security operations team. Additionally, compliance reports should be generated periodically. Which combination of steps will achieve this requirement?
- A
Set up AWS Config rules to evaluate resource compliance and integrate them with an Amazon SNS topic for notifications.
- B
Configure AWS Config to deliver configuration snapshots and compliance reports to an Amazon S3 bucket.
- C
Enable AWS CloudTrail to track changes and integrate with Amazon SNS for compliance notifications.
- D
Use AWS Config conformance packs to automate the evaluation of multiple resources against compliance requirements.
- E
Manually review resource configurations periodically using the AWS Management Console.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, AWS Config rules should be used to evaluate compliance and trigger notifications via Amazon SNS for violations. Additionally, AWS Config must be configured to deliver snapshots and compliance reports to an S3 bucket for periodic reporting. While other options like CloudTrail and conformance packs have their use cases, they do not fully satisfy the outlined requirements.
- A. Correct.
Correct: AWS Config rules evaluate resource configurations against compliance requirements, and integrating them with an Amazon SNS topic ensures notifications are sent when rules are violated.
- B. Correct.
Correct: AWS Config can deliver configuration snapshots and compliance reports to an Amazon S3 bucket, enabling periodic compliance reporting.
- C. Incorrect.
Incorrect: AWS CloudTrail tracks API activity and resource changes but does not evaluate compliance or generate compliance reports. It is not a substitute for AWS Config in this context.
- D. Incorrect.
Incorrect: AWS Config conformance packs help automate compliance evaluation across multiple resources, but they do not directly address the requirement for notifications or periodic compliance reports.
- E. Incorrect.
Incorrect: Manual reviews are not scalable or automated, and they do not fulfill the requirement for notifications or periodic reports.