AWS Service for Configuration Recording and Remediation
Short answer
A Use AWS Config to record, evaluate, and remediate configuration changes on AWS resources.
Question
Key Takeaways
The key insight is distinguishing between audit trail services (CloudTrail) and configuration management services (Config), with the trap being the confusion between tracking API calls versus tracking resource state changes.
This question tests the ability to identify AWS services based on compliance requirements for configuration auditing and remediation. AWS Config is the correct service for recording, evaluating, and remediating resource configurations.
Common mistake: Candidates often choose AWS CloudTrail because it records activity, but CloudTrail does not evaluate configurations or perform automated remediation actions on resources.
Expert Analysis
Why the Answer Is Correct
AWS Config is the dedicated service for recording and evaluating configuration changes across AWS resources. It creates a detailed inventory of your resources and their configurations over time. Crucially, it allows you to define rules to evaluate compliance against policies and supports automated remediation through AWS Systems Manager Automation documents when non-compliance is detected.
Why the Other Options Are Wrong
AWS CloudTrail records API calls for auditing purposes but does not evaluate the configuration state of resources or perform remediation. AWS Secrets Manager is designed for managing sensitive data like passwords and keys, not infrastructure configuration. AWS Trusted Advisor provides best practice checks but lacks the continuous monitoring and remediation capabilities required by the scenario.
Community Comment Notes
Community consensus strongly supports AWS Config, with users noting its specific role in monitoring configuration history. Comments highlight that Config enables both evaluation against policies and automated remediation, which are key differentiators from other security services.
Exam Strategy
Focus on the keywords 'evaluate configuration' and 'remediation'. If the question mentions checking compliance against rules and fixing issues automatically, think AWS Config. If it only mentions logging API calls, think CloudTrail.
Frequently Asked Questions
Why isn't CloudTrail used for configuration remediation?
Can AWS Config automatically fix non-compliant resources?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
d00b229 👍 2A. AWS Config AWS Config provides detailed historical configuration data, allows you to evaluate configurations against policies, and supports automated remediation of non-compliant configurations. It helps with continuous monitoring and auditing of AWS resource configurations.
-
ShaiTay 👍 1 Answered AA. AWS Config is specifically designed for monitoring and recording configuration changes to AWS resources.
-
Inptic 👍 1 Answered Aanswer is AWS Config
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →