ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Compliance monitoring, vulnerability scanning and patching / Question 1

SAP-C03 practice question: Compliance monitoring, vulnerability scanning and patching

Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A retailer's payment environment spans 40 AWS accounts. The compliance team needs a single view of control failures across all accounts, and it needs public S3 buckets and security groups that allow unrestricted SSH to be corrected within minutes of being found. Auditors review the findings each quarter.

The security team wants the findings and the fixes to follow the same company-wide controls, and it wants evidence of each correction for the auditors.

Which solution meets these requirements?

Choose one answer.

  1. A. Turn on AWS Security Hub CSPM for the organization through a delegated administrator, and have an EventBridge rule for the relevant control findings start a Systems Manager Automation runbook.
  2. B. Deploy AWS Config conformance packs to every account through the delegated administrator, and have a compliance analyst fix the reported resources at a monthly review meeting with the account owners.
  3. C. Run Amazon Inspector in each account to scan the EC2 instances for vulnerabilities, and fix any reported issue during the next patch window.
  4. D. Enable Amazon GuardDuty in each account, and have it block public S3 buckets and unrestricted security group rules automatically.
Show the answer and explanation

Answer: A

  • A. Right: Correct. Security Hub CSPM aggregates control findings across accounts in one place, and the EventBridge rule starts a runbook within minutes. The runbook execution history serves as evidence of each fix for the auditors.
  • B. Wrong: A monthly review is far slower than the minutes the security team requires. Manual fixes at the meeting also leave no consistent automated record.
  • C. Wrong: Inspector reports software vulnerabilities on instances and does not detect public S3 buckets or open security groups. The patch window also misses the minutes requirement.
  • D. Wrong: GuardDuty detects threats such as suspicious API calls and compromised instances. It does not change bucket policies or security group rules, so the exposed resources stay open.

Explanation

Security Hub CSPM gives one organization-wide view of control failures, and an EventBridge rule can start a Systems Manager runbook within minutes that leaves its own execution record. Monthly reviews are too slow, while Inspector and GuardDuty neither detect these misconfigurations nor correct them.

Automatic remediation of a security event through EventBridge A security finding or API call event, from services such as GuardDuty, Security Hub CSPM or CloudTrail, matches an EventBridge rule. The rule starts a Systems Manager Automation runbook or Lambda function through an IAM role, which fixes the resource and notifies the team. Security event finding or API call GuardDuty, Security Hub, CloudTrail API calls EventBridge rule event pattern matches type, severity or resource Automation runbook or Lambda function started through an IAM role Resource fixed and team notified within minutes, with a record of the run
Security Hub CSPM collects control findings from all 40 accounts, and the EventBridge rule starts a runbook for each failure.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SAP-C03 practice examPractice Compliance monitoring, vulnerability scanning and patchingAll Compliance monitoring, vulnerability scanning and patching questions

Want more on Compliance monitoring, vulnerability scanning and patching? The 5 full-length practice sets have 8 more Compliance monitoring, vulnerability scanning and patching questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets