AWS Certified Security – Specialty — Question 254

A security engineer has enabled AWS Security Hub in their AWS account, and has enabled the Center for Internet Security (CIS) AWS Foundations compliance standard. No evaluation results on compliance are returned in the Security Hub console after several hours. The engineer wants to ensure that Security Hub can evaluate their resources for CIS AWS Foundations compliance.
Which steps should the security engineer take to meet these requirements?

Answer options

• A. Add full Amazon Inspector IAM permissions to the Security Hub service role to allow it to perform the CIS compliance evaluation.
• B. Ensure that AWS Trusted Advisor is enabled in the account, and that the Security Hub service role has permissions to retrieve the Trusted Advisor security- related recommended actions.
• C. Ensure that AWS Config is enabled in the account, and that the required AWS Config rules have been created for the CIS compliance evaluation.
• D. Ensure that the correct trail in AWS CloudTrail has been configured for monitoring by Security Hub, and that the Security Hub service role has permissions to perform the GetObject operation on CloudTrail's Amazon S3 bucket.

Correct answer: C

Explanation

The correct answer is C because AWS Config must be enabled along with the specific AWS Config rules to properly evaluate resources for CIS compliance. Options A and B are incorrect as they pertain to unrelated services that do not directly influence the CIS compliance evaluation. Option D is also incorrect since CloudTrail monitoring is not a requirement for CIS compliance evaluation in Security Hub.