Which AWS Service Records and Evaluates Configuration Changes?
Short answer
A Use AWS Config to record and evaluate configuration changes and perform remediation actions on AWS resources.
Question
Which AWS service should the company use?
Key Takeaways
This question tests the distinction between configuration compliance services and API logging services, with the common trap being confusing AWS Config with AWS CloudTrail.
AWS Config is the dedicated service for recording, evaluating, and remediating AWS resource configuration changes. This guide establishes why AWS Config is the correct choice over similar auditing and monitoring services.
Common mistake: Choosing AWS CloudTrail (C) because it logs account activity, but it cannot evaluate resource configurations against compliance rules or perform automated remediation.
Expert Analysis
Why the Answer Is Correct
AWS Config is purpose-built to continuously monitor and record AWS resource configurations. It allows you to evaluate these recorded configurations against desired settings using Config Rules and automatically remediate non-compliant resources, perfectly matching all requirements in the question.
Why the Other Options Are Wrong
AWS Secrets Manager (B) is designed for securely storing and retrieving secrets, not tracking configuration changes. AWS CloudTrail (C) records API activity for auditing but lacks native configuration evaluation and automated remediation capabilities. AWS Trusted Advisor (D) provides best practice recommendations across accounts but does not record configuration histories or execute remediation actions.
Community Comment Notes
Commenters correctly highlight AWS Config's capabilities, noting it "provides detailed historical configuration data" and supports "automated remediation of non-compliant configurations." Ramdac also emphasized its ability to "evaluate resources against compliance requirements" as a key differentiator.
Exam Strategy
When a question mentions evaluating configuration compliance or automated remediation, immediately look for AWS Config. CloudTrail is for API logging and account activity, while Config is for configuration state, compliance, and remediation.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
d00b229 👍 2A. AWS Config AWS Config provides detailed historical configuration data, allows you to evaluate configurations against policies, and supports automated remediation of non-compliant configurations. It helps with continuous monitoring and auditing of AWS resource configurations.
-
Ramdac 👍 1 Answered AAWS Config is a service that continuously monitors, records, and evaluates AWS resource configurations. Key capabilities - Configuration tracking – Records configuration changes to AWS resources. - Compliance evaluation – Uses AWS Config Rules to evaluate resources against compliance requirements. - Automated remediation – Can automatically correct noncompliant resources using AWS Systems Manager Automation. - Configuration history – Maintains historical configuration records for auditing. Why not the others? - B. AWS Secrets Manager – Securely stores and rotates secrets such as passwords and API keys. - C. AWS CloudTrail – Records API calls and account activity, showing who performed an action and when. - D. AWS Trusted Advisor – Provides recommendations for cost optimization, security, performance, fault tolerance, and service limits.
-
ShaiTay 👍 1 Answered AA. AWS Config is specifically designed for monitoring and recording configuration changes to AWS resources.
-
Inptic 👍 1 Answered Aanswer is AWS Config
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →