Hotspot Question A security engineer needs to prepare for a security audit of an AWS account. Select the correct AWS resource from the following list to meet each requirement. Select each resource…

Question

Exhibits

Answer Area

• Automatically collect evidence from AWS CloudTrail, AWS Config, and AWS Security Hub for an assessment report.
  Select...AWS Artifact reportsAWS Audit Manager controlsAWS Config conformance packsAWS Config rulesAmazon Detective investigationsAWS Identity and Access Management Access Analyzer internal access analyzers
• Determine which IAM principals within the AWS account have access to a specified resource.AWS Identity and Access Management Access Analyzer internal access analyzers
  Select...AWS Artifact reportsAWS Audit Manager controlsAWS Config conformance packsAWS Config rulesAmazon Detective investigationsAWS Identity and Access Management Access Analyzer internal access analyzers
• Download AWS security and compliance documents on demand.AWS Config rules
  Select...AWS Artifact reportsAWS Audit Manager controlsAWS Config conformance packsAWS Config rulesAmazon Detective investigationsAWS Identity and Access Management Access Analyzer internal access analyzers

Explanation

AWS Security Audit Hotspot - Explanation

Note: There appear to be two errors in the provided answer key. I'll give the correct answers with explanations below.

Dropdown 1 - Automatically collect evidence from CloudTrail, Config, and Security Hub for an assessment report

Correct Answer: AWS Audit Manager controls

The answer was left blank (?) in the question, but this is unambiguously AWS Audit Manager. Its core purpose is to continuously collect and map evidence from CloudTrail (API activity), AWS Config (resource compliance), and Security Hub (security findings) into structured assessment reports for audits (SOC 2, PCI DSS, HIPAA, etc.).

Why the others are wrong:

• AWS Artifact reports - Downloads pre-existing AWS compliance docs; does not collect evidence from your account.
• AWS Config conformance packs - Groups Config rules together for compliance checking; does not produce audit evidence reports.
• AWS Config rules - Evaluates individual resource configurations; not an evidence collection mechanism.
• Amazon Detective investigations - Analyzes security events (GuardDuty findings, CloudTrail) to investigate threats; not an audit evidence tool.
• IAM Access Analyzer - Analyzes resource access policies; unrelated to evidence collection.

Dropdown 2 - Determine which IAM principals within the AWS account have access to a specified resource

Correct Answer: AWS Identity and Access Management Access Analyzer internal access analyzers

IAM Access Analyzer performs policy analysis to identify which principals (users, roles, services) can access a resource. An internal access analyzer is scoped to your own AWS account/organization, finding access paths within the trust boundary (as opposed to external access analyzers that flag external entity access).

Why the others are wrong:

• AWS Audit Manager - Collects audit evidence; doesn't analyze access paths.
• AWS Artifact - Provides compliance documents; has no visibility into your IAM policies.
• AWS Config rules/conformance packs - Evaluate resource configuration state; do not resolve who has access.
• Amazon Detective - Investigates security incidents retrospectively; doesn't enumerate access permissions.

Dropdown 3 - Download AWS security and compliance documents on demand

Correct Answer: AWS Artifact reports (the key incorrectly states "AWS Config rules")

AWS Artifact is the AWS self-service portal for on-demand access to AWS compliance documents: SOC 1/2/3, PCI DSS AOC, ISO 27001 certifications, GDPR DPA, FedRAMP, etc. These are AWS's own third-party audit reports that customers download to satisfy their auditors.

Why "AWS Config rules" is wrong: AWS Config rules evaluate whether your resources comply with desired configurations. They produce compliance status findings - they have nothing to do with downloading AWS's own security documentation.

Why the other options are wrong:

• AWS Audit Manager controls - Collects evidence from your account; doesn't provide AWS's own certification documents.
• AWS Config conformance packs - A bundle of Config rules; same limitation as above.
• Amazon Detective - Security investigation tool; no document repository.
• IAM Access Analyzer - Access analysis tool; unrelated.

Quick Reference Table

No community discussion yet for this question.