A company's network engineer builds and tests network designs for VPCs in a development account. The company needs to monitor the changes that are made to network resources and must ensure strict…

The correct answer is C. Record the current state of network resources by using AWS Config. Create rules that reflect the. Explanation AWS Config is purpose-built for tracking configuration changes to AWS resources over time, making it the ideal solution here - it continuously records the state of network resources (like VPCs, security groups, route tables, and NACLs), maintains a historical…

Submitted by lukas.cz· Mar 6, 2026Network Security, Compliance, and Governance

Question

A company's network engineer builds and tests network designs for VPCs in a development account. The company needs to monitor the changes that are made to network resources and must ensure strict compliance with network security policies. The company also needs access to the historical configurations of network resources. Which solution will meet these requirements?

Options

ACreate an Amazon EventBridge (Amazon CloudWatch Events) rule with a custom pattern to
BCreate custom metrics from Amazon CloudWatch logs. Use the metrics to invoke an AWS
CRecord the current state of network resources by using AWS Config. Create rules that reflect the
DRecord the current state of network resources by using AWS Systems Manager Inventory. Use

How the community answered

(33 responses)

A
9% (3)
B
3% (1)
C
70% (23)
D
18% (6)

Explanation

AWS Config is purpose-built for tracking configuration changes to AWS resources over time, making it the ideal solution here - it continuously records the state of network resources (like VPCs, security groups, route tables, and NACLs), maintains a historical timeline of configuration changes, and allows you to create Config Rules to evaluate resources against desired network security policies for compliance enforcement.

Option A (EventBridge) is incorrect because while EventBridge can detect events, it does not maintain historical configuration records or natively enforce compliance rules against resource configurations. Option B (CloudWatch custom metrics) is incorrect because CloudWatch metrics are designed for performance monitoring, not for tracking configuration state changes or compliance of network resources. Option D (Systems Manager Inventory) is incorrect because SSM Inventory collects software and instance metadata (primarily for EC2 instances), not detailed network resource configuration history or compliance checks.

Memory Tip: Think of AWS Config as a "security camera with a time machine" - it records what your resources look like, stores the history, and alerts you when something breaks the rules. Whenever an exam question mentions configuration history + compliance monitoring, Config is almost always the answer.

Topics

#AWS Config#Configuration Management#Network Security#Compliance

Community Discussion

No community discussion yet for this question.

Full ANS-C01 Practice