Evaluating Workload Architecture with Well-Architected Tool
Short answer
C Use the AWS Well-Architected Tool to define the workload, complete the security pillar questionnaire, and generate an improvement plan.
Question
The security analyst needs to evaluate whether the workload architecture aligns with AWS security best practices and to identify potential security risks.
Which solution will meet these requirements?
Key Takeaways
This question tests the ability to distinguish between data classification services, vulnerability scanners, and architectural review tools when evaluating workload security.
The AWS Well-Architected Tool evaluates workload architecture against AWS security best practices and generates improvement plans, making it the correct choice for architectural risk identification.
Common mistake: Choosing B (Macie) because the workload processes PII, but Macie cannot scan RDS and does not evaluate overall architecture against best practices.
Expert Analysis
Architectural Evaluation Requirement The core requirement is to evaluate whether the workload architecture aligns with AWS security best practices and to identify potential security risks. This explicitly calls for an architectural review mechanism, not just a targeted data classification or vulnerability scan.
AWS Well-Architected Tool Option C uses the AWS Well-Architected Tool, which is specifically designed for this purpose. By defining the workload and completing the Security Pillar questionnaire, the tool evaluates the architecture against AWS best practices and generates an improvement plan to remediate identified risks.
Distractors and Limitations Option A (Trusted Advisor) provides account-level best practice checks but lacks the workload-specific architectural questionnaire and improvement plan generation. Option B (Macie) is a trap due to the mention of PII; Macie only scans S3 buckets, not RDS DB instances, and it classifies data rather than reviewing architecture. Option D (Amazon Inspector) scans for software vulnerabilities and unintended network accessibility in compute resources, but it does not evaluate overall architectural design against the Well-Architected Framework. As one comment noted, the PII reference is a distractor; the actual need is an architectural review, making C the correct choice.
Official Reference
https://docs.aws.amazon.com/wellarchitected/latest/userguide/welcome.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks to evaluate workload architecture or alignment with best practices, immediately look for the AWS Well-Architected Tool. Be cautious of distractors like PII (Macie) or vulnerabilities (Inspector) that address specific data or compute issues but fail to assess the overall architectural design.
Community Votes
77% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
c99a31b 👍 1 Answered CA tricky question-- most time when the question is about PII or sensitive data, Macie will be part of the answer. But the requirement does not mention PII or sensitive data! So B is out and C is the answer
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →