CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating AWS Security Audits: A Question Walkthrough
Unpack a key AWS Certified Security - Specialty exam question about auditing AWS resources with clarity and confidence.
A common stumbling block for candidates is determining which AWS service provides the best insights into resource configurations and compliance. Understanding the purpose behind each service is crucial for success on the exam.
The question
A company is undergoing an internal audit of its AWS resources to ensure compliance with its security policies. The audit team needs to determine which AWS services are being used, their configurations, and their associated security controls. Which AWS service should the team utilize to gather detailed information about resource configurations and compliance status?
- A) AWS CloudTrail
- B) AWS Config
- C) AWS CloudFormation
- D) AWS Trusted Advisor
Think before you scroll
Before selecting an answer, consider what each service specifically does. The exam rewards clarity on how each AWS service supports compliance and auditing tasks. Assess which service provides the most detailed view of configurations and compliance status.
The answer
The correct option is B) AWS Config. AWS Config tracks the configurations of AWS resources and evaluates them against compliance policies. It is specifically designed for auditing and provides detailed information that the audit team needs.
Why the other options lose
- A) AWS CloudTrail: This service tracks API calls made in your AWS account. While it logs activities, it does not provide information on the configurations of resources or their compliance status, making it unsuitable for this audit task.
- C) AWS CloudFormation: This service is focused on infrastructure as code. It allows users to create and manage AWS resources using templates, but it does not provide insights into the current configurations or compliance status of those resources.
- D) AWS Trusted Advisor: Trusted Advisor provides best practice recommendations, but it does not give detailed compliance information regarding resource configurations. It is more about optimizing your AWS environment rather than auditing it.
The concept behind it
Understanding AWS Config is key for any compliance-related task. It continuously monitors and records AWS resource configurations, allowing organizations to assess compliance with internal policies and external regulations. This service is crucial for maintaining security governance in your cloud environment.
Exam trap to remember
Remember: AWS Config is your go-to for configuration auditing and compliance checks.