Which AWS Service Records and Evaluates Configuration Changes?

Understand AWS Cloud security, governance, and compliance concepts. Identify components and resources for security.

A company has a compliance requirement to record and evaluate configuration changes, as well as perform remediation actions on AWS resources. Which AWS service should the company use?

AWS Config Correct Answer
AWS Secrets Manager
AWS CloudTrail
AWS Trusted Advisor

Answer Correct answer: A — Use AWS Config to record and evaluate configuration changes and perform remediation actions on AWS resources.

Community Insight

This question tests the distinction between configuration compliance services and API logging services, with the common trap being confusing AWS Config with AWS CloudTrail.

AWS Config is the dedicated service for recording, evaluating, and remediating AWS resource configuration changes. This guide establishes why AWS Config is the correct choice over similar auditing and monitoring services.

Choosing AWS CloudTrail (C) because it logs account activity, but it cannot evaluate resource configurations against compliance rules or perform automated remediation.

Community Discussion (4 comments)

Ramdac 👍 1 Selected: A

AWS Config is a service that continuously monitors, records, and evaluates AWS resource configurations. Key capabilities - Configuration tracking – Records configuration changes to AWS resources. - Compliance evaluation – Uses AWS Config Rules to evaluate resources against compliance requirements. - Automated remediation – Can automatically correct noncompliant resources using AWS Systems Manager Automation. - Configuration history – Maintains historical configuration records for auditing. Why not the others? - B. AWS Secrets Manager – Securely stores and rotates secrets such as passwords and API keys. - C. AWS CloudTrail – Records API calls and account activity, showing who performed an action and when. - D. AWS Trusted Advisor – Provides recommendations for cost optimization, security, performance, fault tolerance, and service limits.

Inptic 👍 1 Selected: A

answer is AWS Config

ShaiTay 👍 1 Selected: A

A. AWS Config is specifically designed for monitoring and recording configuration changes to AWS resources.

d00b229 👍 2

A. AWS Config AWS Config provides detailed historical configuration data, allows you to evaluate configurations against policies, and supports automated remediation of non-compliant configurations. It helps with continuous monitoring and auditing of AWS resource configurations.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

AWS Config is purpose-built to continuously monitor and record AWS resource configurations. It allows you to evaluate these recorded configurations against desired settings using Config Rules and automatically remediate non-compliant resources, perfectly matching all requirements in the question.

Why the Other Options Are Wrong

AWS Secrets Manager (B) is designed for securely storing and retrieving secrets, not tracking configuration changes. AWS CloudTrail (C) records API activity for auditing but lacks native configuration evaluation and automated remediation capabilities. AWS Trusted Advisor (D) provides best practice recommendations across accounts but does not record configuration histories or execute remediation actions.

Community Comment Notes

Commenters correctly highlight AWS Config's capabilities, noting it "provides detailed historical configuration data" and supports "automated remediation of non-compliant configurations." Ramdac also emphasized its ability to "evaluate resources against compliance requirements" as a key differentiator.

Exam Strategy

When a question mentions evaluating configuration compliance or automated remediation, immediately look for AWS Config. CloudTrail is for API logging and account activity, while Config is for configuration state, compliance, and remediation.

Related Analysis

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide