Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool): SCS-C03 study notes and practice questions

What to know for the exam

These questions describe an auditor who wants proof, a team that needs AWS’s own compliance report, or a request to review a workload against security best practice. Each points to a different service, and the answer depends on whose evidence is wanted and what it is for.

What decides the answer

• AWS Artifact gives you AWS’s own compliance reports, such as SOC and ISO reports, and agreements such as the business associate addendum (BAA) for HIPAA. These documents describe the controls AWS operates, not your configuration.
• Shared responsibility still applies. An AWS report covers AWS’s side. You still need evidence for how you configured your own resources.
• Evidence about your own resources comes from services that already record it. AWS Config keeps configuration history and rule results, and conformance packs group rules that map to a framework. An aggregator gives one view across accounts and Regions. Security Hub CSPM scores accounts against standards such as AWS Foundational Security Best Practices, CIS and PCI DSS. CloudTrail shows who made each change.
• An evidence bucket in the log archive or audit account, with S3 Object Lock, keeps exported reports and snapshots of compliance results for the audit period, so they cannot be altered afterward.
• AWS Audit Manager ran assessments against frameworks, collected evidence from Config, CloudTrail and Security Hub CSPM, and organized it by control. It is closed to new customers from April 30, 2026. Existing customers can keep using it, and the exam guide still lists it, so know what it does. For a new design, build the evidence from Config conformance packs and aggregators, Security Hub CSPM standards and an evidence bucket.
• AWS Well-Architected Tool records reviews of a workload against the Well-Architected Framework, including the Security pillar, and produces an improvement plan. It is a periodic review, not continuous evidence collection.

How to choose

Common traps

• Choosing Audit Manager for a new build. It is closed to new customers. Recognize it in an answer, but prefer Config, Security Hub CSPM and Artifact.
• Using Artifact for your own evidence. Artifact holds AWS’s documents only.
• Assuming AWS’s SOC report covers your workloads. It covers AWS’s controls, and shared responsibility still applies to you.
• Using the Well-Architected Tool to collect audit evidence. It records reviews; it does not gather evidence continuously.
• Expecting an evidence tool to fix problems. Collection and reporting are separate from remediation, which is a Config or automation job.
• Keeping evidence where it can be edited. Store exported results in a locked bucket outside the workload accounts.

Read the AWS Artifact user guide, the conformance packs guide and the Security pillar of the Well-Architected Framework.

Try the 1 practice question ↓