AWS Certified Security – Specialty — Question 169

A security engineer is setting up a new AWS account. The engineer has been asked to continuously monitor the company's AWS account using automated compliance checks based on AWS best practices and Center for Internet Security (CIS) AWS Foundations Benchmarks.
How can the security engineer accomplish this using AWS services?

Answer options

• A. Enable AWS Config and set it to record all resources in all Regions and global resources. Then enable AWS Security Hub and confirm that the CIS AWS Foundations compliance standard is enabled.
• B. Enable Amazon Inspector and configure it to scan all Regions for the CIS AWS Foundations Benchmarks. Then enable AWS Security Hub and configure it to ingest the Amazon Inspector findings.
• C. Enable Amazon Inspector and configure it to scan all Regions for the CIS AWS Foundations Benchmarks. Then enable AWS Shield in all Regions to protect the account from DDoS attacks.
• D. Enable AWS Config and set it to record all resources in all Regions and global resources. Then enable Amazon Inspector and configure it to enforce CIS AWS Foundations Benchmarks using AWS Config rules.

Correct answer: A

Explanation

The correct answer is A because enabling AWS Config allows for continuous monitoring of resources and compliance checks, while AWS Security Hub provides a central view for security alerts and compliance status, including the CIS benchmarks. Options B and C incorrectly focus on Amazon Inspector, which does not provide the same level of continuous compliance monitoring as AWS Config. Option D also incorrectly suggests that Amazon Inspector can enforce compliance through AWS Config rules, which is not its primary function.