SOA-C03 practice question: AWS Config and compliance monitoring (2 of 2)

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank must apply the same set of 30 AWS Config rules, aligned with an industry framework, to all 40 accounts in its AWS Organization, including accounts added later. Auditors need a single view of compliance across every account and Region. AWS Config recording is already turned on everywhere. Which TWO actions meet these requirements with the LEAST operational overhead? (Choose two.)

Choose two answers.

A. Deploy the rules as an organization conformance pack from the management account or a delegated administrator account.
B. Use the Trusted Advisor organizational view to run the 30 framework checks in every account and combine the results.
C. Create an AWS Config aggregator for the whole organization in the delegated administrator account to show compliance across accounts and Regions.
D. Create the 30 rules by hand in each account and Region, and export each account's compliance report to a shared S3 bucket every week.
E. Share the conformance pack from the management account with all member accounts by using AWS Resource Access Manager.

Show the answer and explanation

Answers: A, C

A. Right: Correct. An organization conformance pack deploys the same rules, and any remediation actions, to every member account. Accounts that join the organization later receive it automatically. Learn more: Managing conformance packs across all accounts in your organization (opens in a new tab)
B. Wrong: Trusted Advisor runs its own fixed checks and cannot run custom AWS Config rules. It does not give a view of Config rule compliance. Learn more: AWS Trusted Advisor check reference (opens in a new tab)
C. Right: Correct. An organization aggregator collects configuration and compliance data from all member accounts and Regions into one account. Auditors get the single view they asked for. Learn more: Multi-account multi-Region data aggregation (opens in a new tab)
D. Wrong: This could work for now, but 40 accounts make it slow and error-prone, and new accounts would need the same steps. Weekly exports also give auditors stale data. Learn more: AWS Config rules (opens in a new tab)
E. Wrong: AWS RAM does not share conformance packs. Organization-wide deployment is done with the organization conformance pack APIs. Learn more: What is AWS Resource Access Manager? (opens in a new tab)

Explanation

AWS Config has organization-level features for exactly this. Organization conformance packs push a bundle of rules to all member accounts, including new ones, and an organization aggregator collects compliance data from every account and Region. Manual setup, Trusted Advisor and AWS RAM do not provide both parts.

SOA-C03 practice question: AWS Config and compliance monitoring (2 of 2)

Explanation

Study

Keep practicing