DOP-C02 practice question: AWS Config rules and automatic remediation (2 of 2)
Incident and Event Response A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university has 60 accounts in an AWS Organization. Each department's account must comply with a set of security controls, including encrypted EBS volumes and restricted security groups, and the central IT office needs one view of compliance across all accounts.
The IT office also wants the non-compliant resources that match a few of these controls to be fixed automatically, using managed remediation with an approved runbook. When the IT office changes a rule, the change should reach every account at once.
The IT office wants the setup to be deployed centrally, with no separate configuration in each department.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Turn on AWS Config only in the management account, and use its compliance data to show the status of every department account, since the management account can see the others' resources.
BB. Create a Lambda function that polls each account's security group rules every minute with the EC2 API, and sends the results to a central dashboard that the IT office reviews.
CC. Deploy a Config conformance pack with the control rules from a delegated administrator account, so that the same rules are created in every department account from one place.
DD. Attach a service control policy that denies changes to AWS Config and the remediation roles in the department accounts, and ask each department to create the rules locally.
EE. Turn on automatic remediation for each managed rule that supports it, using the approved Systems Manager Automation runbook and a remediation role, with the setting deployed through the same conformance pack.
C. Right: Correct. A conformance pack deployed through an organization applies a set of Config rules to member accounts from one central place, and the IT office sees their status together. Departments do not configure the rules themselves. Learn more: Conformance Packs for AWS Config (opens in a new tab)
D. Wrong: The policy protects Config from changes, but each department would create its own rules, which breaks the central deployment requirement. A rule change would also need work in all 60 accounts. Learn more: Service control policies (SCPs) (opens in a new tab)
A Config conformance pack deployed by a delegated administrator creates the same rules in every member account, and the IT office sees compliance across the organization. Automatic remediation with an approved Systems Manager runbook fixes the matching controls, and the setting can ride in the same pack. Management-account-only Config, custom polling and a deny policy alone each miss part of the design.
Want more on AWS Config rules and automatic remediation? The 5 full-length practice sets have 9 more AWS Config rules and automatic remediation questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →