A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure…

Question

Options

• AUse AWS Systems Manager Configuration Compliance. Use calls to the put-compliance-items
• BUse custom Java code running on an EC2 instance. Set up EC2 Auto Scaling for the instance
• CUse AWS Config. Identify all EC2 instances to be audited by enabling Config Recording on all
• DUse AWS CloudTrail. Identify all EC2 instances to be audited by analyzing all calls to the EC2

• A
  9% (4)
• B
  16% (7)
• C
  73% (33)
• D
  2% (1)

Explanation

Explanation

AWS Config (Option C) is the ideal solution because it provides continuous, automated monitoring of EC2 instance configurations-including tenancy type (Dedicated Host vs. shared)-without requiring custom code or manual effort. Config's managed rule ec2-instance-in-vpc and custom rules can automatically flag instances not running on Dedicated Hosts, generating compliance reports with minimal setup and ongoing administrative burden.

Option A is incorrect because AWS Systems Manager Configuration Compliance requires manual put-compliance-items API calls, meaning engineers must write and maintain custom logic to check tenancy, adding significant administrative overhead compared to Config's built-in evaluation engine.

Option B is incorrect because writing custom Java code and managing it via Auto Scaling introduces the highest administrative overhead of all options-requiring code development, maintenance, scaling configuration, and ongoing operational support.

Option D is incorrect because CloudTrail records API call history (who did what and when), not current resource configuration state; auditing compliance by parsing CloudTrail logs for EC2 tenancy would be complex, error-prone, and resource-intensive.

Memory Tip: Think of AWS Config as a continuous compliance camera-it constantly watches your resource configurations and automatically reports drift. CloudTrail is the security camera recording events, while Config is the inspector checking current state. When you hear "audit compliance," think Config first.

No community discussion yet for this question.