AWS Config and compliance monitoring: SOA-C03 study notes and practice questions
What to know about AWS Config and compliance monitoring for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
Compliance questions ask how to detect and fix resources that break your rules, across accounts, with evidence auditors can review.
AWS Config
The configuration recorder tracks resource configurations and their history; delivers snapshots and history to S3.
Rules evaluate resources: AWS managed rules (hundreds, such as encrypted-volumes, restricted-ssh, s3-bucket-public-read-prohibited, required-tags) or custom rules (Lambda or Guard policy language).
Rules trigger on configuration changes or periodically.
Remediation actions run Systems Manager Automation runbooks, manually or automatically, with retries.
Conformance packs bundle rules and remediations (such as an operational best practices pack for a standard) and deploy as one unit; organization conformance packs and organization rules deploy to every account.
Aggregators collect compliance data from many accounts and Regions into one view.
Advanced queries search current configurations with SQL.
The compliance timeline shows when each resource was compliant, for auditors.
Related services
Service
Role in compliance
AWS Security Hub
Runs security standards (such as CIS and AWS Foundational Security Best Practices) using Config, and gathers findings
AWS Audit Manager
Collects evidence mapped to frameworks for audits
AWS Artifact
AWS’s own compliance reports
AWS CloudTrail
Who made each change
AWS Control Tower detective controls
Config rules deployed as guardrails
Common traps
Config prevents changes. It doesn’t; it detects and can remediate. Prevention is SCPs and IAM.
Deploying the same rules account by account. Use organization conformance packs.
Config vs CloudTrail. Config answers “what is it like now and before”; CloudTrail answers “who changed it”.
Forgetting the recorder must be on in each Region for Config rules to work there.
A public library's security standard says no security group may allow SSH from 0.0.0.0/0.
Staff sometimes add such rules while troubleshooting and forget to remove them. The library wants any security group that breaks the rule to be found and fixed automatically within minutes, with a compliance history for its auditors.
Which solution meets these requirements with the LEAST custom code?
Choose one answer.
AA. Turn on GuardDuty, and create a suppression rule that archives findings about security groups with open SSH access.
BB. Turn on the AWS Config restricted-ssh managed rule with automatic remediation that runs the AWS-DisablePublicAccessForSecurityGroup runbook.
CC. Write a Lambda function that runs every hour, lists all security groups, and removes any rule that allows SSH from 0.0.0.0/0.
DD. Run Amazon Inspector network reachability scans each week and have staff remove the rules that the findings report.
AWS Config managed rules check resource configurations as they change and keep a compliance timeline that auditors can review. Attaching automatic remediation with a Systems Manager Automation runbook fixes noncompliant resources without custom code. GuardDuty and Inspector are detection services for threats and vulnerabilities, not configuration compliance tools.
A regional bank must apply the same set of 30 AWS Config rules, aligned with an industry framework, to all 40 accounts in its AWS Organization, including accounts added later.
Auditors need a single view of compliance across every account and Region. AWS Config recording is already turned on everywhere.
Which TWO actions meet these requirements with the LEAST operational overhead? (Choose two.)
Choose two answers.
AA. Deploy the rules as an organization conformance pack from the management account or a delegated administrator account.
BB. Use the Trusted Advisor organizational view to run the 30 framework checks in every account and combine the results.
CC. Create an AWS Config aggregator for the whole organization in the delegated administrator account to show compliance across accounts and Regions.
DD. Create the 30 rules by hand in each account and Region, and export each account's compliance report to a shared S3 bucket every week.
EE. Share the conformance pack from the management account with all member accounts by using AWS Resource Access Manager.
D. Wrong: This could work for now, but 40 accounts make it slow and error-prone, and new accounts would need the same steps. Weekly exports also give auditors stale data. Learn more: AWS Config rules (opens in a new tab)
AWS Config has organization-level features for exactly this. Organization conformance packs push a bundle of rules to all member accounts, including new ones, and an organization aggregator collects compliance data from every account and Region. Manual setup, Trusted Advisor and AWS RAM do not provide both parts.
Want more on AWS Config and compliance monitoring? The 5 full-length practice sets have 8 more AWS Config and compliance monitoring questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →