SCS-C03 practice question: Compliance rules and remediation (AWS Config, Security Hub CSPM)
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A bank runs 150 AWS accounts across three Regions. Its audit team requires a fixed set of AWS Config rules, covering encryption, public access, and logging, to run in every account and Region. Accounts are created often, and the audit team needs one view of noncompliant resources across the organization.
The platform team wants new accounts to receive the same rules without a manual step, and it does not want to maintain 450 separate rule sets. The delegated administrator for AWS Config is in the security account.
Which solution meets these requirements?
Choose one answer.
AA. Deploy a Config conformance pack to each account and Region separately with a self-managed CloudFormation StackSet. Add each new account to the StackSet target list when it is created.
BB. From the delegated administrator account, deploy an organization conformance pack to all accounts in each Region. Enable an organization aggregator, so that the audit team sees noncompliance in one view.
CC. Turn on the managed Config rules individually in the management account, and create an aggregator there. Member accounts keep their own rules, and the audit team reads the management account's findings for everything.
DD. Turn on AWS Security Hub CSPM with its standards in each account, and rely on the aggregated findings. The platform team reviews each finding in the console every week and fixes the resources by hand.
Show the answer and explanation
Answer: B
A. Wrong: The rules would deploy, but the target list must be updated for every new account, which is the manual step the platform team wants to avoid. Self-managed StackSets also need deployment roles in each account.
B. Right: Correct. An organization conformance pack deploys the same rules to every account in the organization, including accounts created later, from one definition. An organization aggregator gives the audit team a single view across accounts and Regions. Learn more: Conformance packs (opens in a new tab)
C. Wrong: Rules in the management account evaluate only that account's resources, so the other 149 accounts are not checked. The aggregator would show only what the management account has evaluated.
D. Wrong: Security Hub CSPM standards show control results, but they do not deploy the audit team's custom Config rule set across the organization. A weekly console review is the manual process the platform team wants to avoid.
Explanation
Organization conformance packs deploy one set of Config rules to all accounts in each Region, including new accounts, and an organization aggregator collects their results in one view. The StackSet, management-account-only, and Security Hub CSPM options either miss new accounts or do not deploy the required rules.
Want more on Compliance rules and remediation (AWS Config, Security Hub CSPM)? The 5 full-length practice sets have 5 more Compliance rules and remediation (AWS Config, Security Hub CSPM) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →