Compliance monitoring, vulnerability scanning and patching: SAP-C03 study notes and practice questions

What to know for the exam

These questions ask how to know, at all times and in every account, whether resources meet a standard, and how to find and patch vulnerabilities without manual sweeps.

AWS Config

• Managed rules cover common checks (encrypted volumes, public buckets, required tags); custom rules use Lambda or Guard policy syntax.
• Organization rules and conformance packs deploy the same rules to every account from a delegated administrator. Conformance packs bundle rules and remediations into one deployable unit, with sample packs for frameworks such as CIS and NIST.
• Remediation runs a Systems Manager Automation runbook, manually or automatically, with retry limits.
• An aggregator shows compliance across accounts and Regions.

Security Hub CSPM

• Runs security standards as automated controls: AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, PCI DSS, NIST SP 800-53 and others. It uses Config service-linked rules under the hood, so Config recording must be on.
• Central configuration from the delegated administrator sets which standards and controls are enabled per OU or account.
• Findings use the AWS Security Finding Format and go to EventBridge, so a rule can trigger remediation or a ticket.

Vulnerability scanning with Amazon Inspector

• Scans EC2 instances (through the SSM Agent, or agentless with EBS snapshots), ECR container images (on push and continuously as new CVEs appear), and Lambda functions and their code.
• Enable for the organization from a delegated administrator with auto-enable for new accounts.
• Findings are scored for your environment (for example network reachability) and can feed EventBridge and Security Hub.
• Inspector also runs CIS benchmark assessments for EC2 operating systems.

Patching with Systems Manager

• Patch Manager uses patch baselines (which patches, auto-approval delay) and runs scans or installs.
• Patch policies through Quick Setup apply patching across accounts and Regions in the organization from one configuration.
• Maintenance windows control when patching happens; patch compliance shows in Systems Manager and Security Hub.
• Immutable patterns (rebuild AMIs with EC2 Image Builder, roll the Auto Scaling group) also count as patching for stateless fleets.

How to choose

Common traps

• Scheduled Lambda scripts that scan accounts when Config and Security Hub CSPM do it natively.
• Security Hub CSPM without Config recording, so controls can’t evaluate.
• GuardDuty for vulnerabilities; it detects threats, Inspector finds vulnerabilities.
• Enabling Inspector account by account instead of organization-wide.
• Patching by hand in each account or with per-account cron jobs.

Try the 1 practice question ↓