AWS Service for Configuration Recording and Remediation
A company has a compliance requirement to record and evaluate configuration changes, as well as perform remediation actions on AWS resources. Which AWS service should the company use?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key insight is distinguishing between audit trail services (CloudTrail) and configuration management services (Config), with the trap being the confusion between tracking API calls versus tracking resource state changes.
This question tests the ability to identify AWS services based on compliance requirements for configuration auditing and remediation. AWS Config is the correct service for recording, evaluating, and remediating resource configurations.
Candidates often choose AWS CloudTrail because it records activity, but CloudTrail does not evaluate configurations or perform automated remediation actions on resources.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Config is the dedicated service for recording and evaluating configuration changes across AWS resources. It creates a detailed inventory of your resources and their configurations over time. Crucially, it allows you to define rules to evaluate compliance against policies and supports automated remediation through AWS Systems Manager Automation documents when non-compliance is detected.Why the Other Options Are Wrong
AWS CloudTrail records API calls for auditing purposes but does not evaluate the configuration state of resources or perform remediation. AWS Secrets Manager is designed for managing sensitive data like passwords and keys, not infrastructure configuration. AWS Trusted Advisor provides best practice checks but lacks the continuous monitoring and remediation capabilities required by the scenario.Community Comment Notes
Community consensus strongly supports AWS Config, with users noting its specific role in monitoring configuration history. Comments highlight that Config enables both evaluation against policies and automated remediation, which are key differentiators from other security services.Exam Strategy
Focus on the keywords 'evaluate configuration' and 'remediation'. If the question mentions checking compliance against rules and fixing issues automatically, think AWS Config. If it only mentions logging API calls, think CloudTrail.
Frequently Asked Questions
Why isn't CloudTrail used for configuration remediation?
CloudTrail logs API calls for auditing but does not track resource configuration states or trigger remediation actions.
Can AWS Config automatically fix non-compliant resources?
Yes, AWS Config can invoke Systems Manager Automation documents to automatically remediate non-compliant configurations.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →