Exams / SCS-C03 / Study guide / Compliance rules and remediation (AWS Config, Security Hub CSPM)
Compliance rules and remediation (AWS Config, Security Hub CSPM): SCS-C03 study notes and practice questions
What to know about Compliance rules and remediation (AWS Config, Security Hub CSPM) for the SCS-C03 exam, from the Security Foundations and Governance domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a need to find noncompliant resources, fix them automatically, or show an auditor that resources stayed compliant over time. The key distinction is detective versus preventive. Config keeps the state history and runs the rules, and Security Hub CSPM gathers the results into one view.
What decides the answer
AWS Config records configuration changes for supported resources and keeps a history, so you can see what a security group allowed on an earlier date. Recording must be on in each account and Region you need covered.
Config rules evaluate resources when their configuration changes or on a schedule. Managed rules cover common checks. Custom rules use AWS Lambda or Guard policy rules.
Conformance packs deploy a set of rules and remediation actions as one unit. An organization conformance pack can be deployed to every account from a delegated administrator.
Remediation runs an AWS Systems Manager Automation document against a noncompliant resource, using a remediation role that you supply. It can run automatically, with retries, or on demand.
Security Hub CSPM runs security standards such as the AWS Foundational Security Best Practices standard. Many of its controls are evaluated by AWS Config rules, so Config recording must be on for those controls to report.
Detective, not preventive. Config and Security Hub CSPM find and fix problems after the fact. An SCP, an RCP or a declarative policy stops the action before it happens.
Config versus CloudTrail. CloudTrail records who made an API call. Config records what a resource looks like and whether it is compliant.
How to choose
Scenario wording
Pick
Find every bucket that allows public read across the organization
Config rule with an organization aggregator, or the matching Security Hub CSPM control
Fix a noncompliant bucket automatically
Config remediation using an SSM Automation document
Deploy the same set of rules to every account
Organization conformance pack
Show what a security group rule looked like last month
Config configuration history
Prevent anyone from making a bucket public
SCP, RCP or S3 Block Public Access; preventive controls
One dashboard of compliance against several standards
Security Hub CSPM
Common traps
Choosing Config to prevent a change. It detects and remediates. Use an SCP or RCP to prevent.
Recording turned off in a Region, so rules never evaluate there.
Using CloudTrail to answer “is this resource compliant now?” CloudTrail shows activity, not current state.
Remediation with a role that is too broad. The remediation role should allow only the fix.
Expecting Security Hub CSPM to fix anything. It finds and aggregates. Remediation runs through Config or through EventBridge-driven automation.
Calling the service Security Hub when the question is about standards and controls. Use the name Security Hub CSPM for that feature.
A bank runs 150 AWS accounts across three Regions. Its audit team requires a fixed set of AWS Config rules, covering encryption, public access, and logging, to run in every account and Region. Accounts are created often, and the audit team needs one view of noncompliant resources across the organization.
The platform team wants new accounts to receive the same rules without a manual step, and it does not want to maintain 450 separate rule sets. The delegated administrator for AWS Config is in the security account.
Which solution meets these requirements?
Choose one answer.
AA. Deploy a Config conformance pack to each account and Region separately with a self-managed CloudFormation StackSet. Add each new account to the StackSet target list when it is created.
BB. From the delegated administrator account, deploy an organization conformance pack to all accounts in each Region. Enable an organization aggregator, so that the audit team sees noncompliance in one view.
CC. Turn on the managed Config rules individually in the management account, and create an aggregator there. Member accounts keep their own rules, and the audit team reads the management account's findings for everything.
DD. Turn on AWS Security Hub CSPM with its standards in each account, and rely on the aggregated findings. The platform team reviews each finding in the console every week and fixes the resources by hand.
Show the answer and explanation
Answer: B
A. Wrong: The rules would deploy, but the target list must be updated for every new account, which is the manual step the platform team wants to avoid. Self-managed StackSets also need deployment roles in each account.
B. Right: Correct. An organization conformance pack deploys the same rules to every account in the organization, including accounts created later, from one definition. An organization aggregator gives the audit team a single view across accounts and Regions. Learn more: Conformance packs (opens in a new tab)
C. Wrong: Rules in the management account evaluate only that account's resources, so the other 149 accounts are not checked. The aggregator would show only what the management account has evaluated.
D. Wrong: Security Hub CSPM standards show control results, but they do not deploy the audit team's custom Config rule set across the organization. A weekly console review is the manual process the platform team wants to avoid.
Explanation
Organization conformance packs deploy one set of Config rules to all accounts in each Region, including new accounts, and an organization aggregator collects their results in one view. The StackSet, management-account-only, and Security Hub CSPM options either miss new accounts or do not deploy the required rules.
Want more on Compliance rules and remediation (AWS Config, Security Hub CSPM)? The 5 full-length practice sets have 5 more Compliance rules and remediation (AWS Config, Security Hub CSPM) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Compliance rules and remediation (AWS Config, Security Hub CSPM)