AWS Config rules and automatic remediation: DOP-C02 study notes and practice questions
What to know about AWS Config rules and automatic remediation for the DOP-C02 exam, from the Incident and Event Response domain (14% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
A regional bank keeps customer statement exports in Amazon S3 buckets across 25 accounts. An AWS Config rule checks whether each bucket blocks public access, and the bank wants any bucket that becomes non-compliant to be fixed automatically.
Remediation must be performed by a role that can change only the public-access settings of the bucket, and the fix should be retried a few times if a change fails because of a temporary error. The security team also needs to see each remediation attempt in the Config console.
The team wants the remediation to use an AWS-managed runbook rather than custom code.
Which configuration meets these requirements?
Choose one answer.
AA. Turn on the Config rule in each account and leave it in evaluation-only mode, so that the security team reviews the noncompliant buckets each day and fixes them by hand.
BB. Create an EventBridge rule for CloudTrail PutBucketPublicAccessBlock events that invokes a Lambda function, which removes any public access it finds on the bucket.
CC. Add a service control policy to each account that denies any change to S3 bucket public-access settings, so that buckets cannot become public in the first place.
DD. Attach automatic remediation to the Config rule that runs an AWS Systems Manager Automation document to block public access, with a retry count and a scoped remediation role.
AWS Config remediation can run a Systems Manager Automation runbook automatically for each non-compliant resource, with retry attempts and a remediation role. Results appear with the rule in the Config console. Evaluation-only rules, custom functions and preventive policies each miss the automatic fix, the scoped role or the visibility the bank wants.
A university has 60 accounts in an AWS Organization. Each department's account must comply with a set of security controls, including encrypted EBS volumes and restricted security groups, and the central IT office needs one view of compliance across all accounts.
The IT office also wants the non-compliant resources that match a few of these controls to be fixed automatically, using managed remediation with an approved runbook. When the IT office changes a rule, the change should reach every account at once.
The IT office wants the setup to be deployed centrally, with no separate configuration in each department.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Turn on AWS Config only in the management account, and use its compliance data to show the status of every department account, since the management account can see the others' resources.
BB. Create a Lambda function that polls each account's security group rules every minute with the EC2 API, and sends the results to a central dashboard that the IT office reviews.
CC. Deploy a Config conformance pack with the control rules from a delegated administrator account, so that the same rules are created in every department account from one place.
DD. Attach a service control policy that denies changes to AWS Config and the remediation roles in the department accounts, and ask each department to create the rules locally.
EE. Turn on automatic remediation for each managed rule that supports it, using the approved Systems Manager Automation runbook and a remediation role, with the setting deployed through the same conformance pack.
C. Right: Correct. A conformance pack deployed through an organization applies a set of Config rules to member accounts from one central place, and the IT office sees their status together. Departments do not configure the rules themselves. Learn more: Conformance Packs for AWS Config (opens in a new tab)
D. Wrong: The policy protects Config from changes, but each department would create its own rules, which breaks the central deployment requirement. A rule change would also need work in all 60 accounts. Learn more: Service control policies (SCPs) (opens in a new tab)
A Config conformance pack deployed by a delegated administrator creates the same rules in every member account, and the IT office sees compliance across the organization. Automatic remediation with an approved Systems Manager runbook fixes the matching controls, and the setting can ride in the same pack. Management-account-only Config, custom polling and a deny policy alone each miss part of the design.
Want more on AWS Config rules and automatic remediation? The 5 full-length practice sets have 9 more AWS Config rules and automatic remediation questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →