A company has a new requirement stating that all resources in AWS must be tagged according to a set policy. Which AWS service should be used to enforce and continually identify all resources that…

Question

Options

• AAWS CloudTrail
• BAmazon Inspector
• CAWS Config
• DAWS Systems Manager

• A
  5% (1)
• C
  90% (18)
• D
  5% (1)

Explanation

AWS Config is the right tool here because it continuously monitors your AWS resources against defined rules - including tag compliance policies - and flags any resource that drifts out of conformance, giving you an ongoing compliance dashboard rather than a one-time check.

Why the distractors are wrong:

• A. AWS CloudTrail records API activity logs (who did what and when), not resource configuration state - it can't evaluate whether a resource is tagged correctly.
• B. Amazon Inspector is a vulnerability assessment service focused on security findings in EC2 instances and container images, not configuration compliance.
• D. AWS Systems Manager manages operational tasks on resources (patching, run commands, parameter store), but doesn't enforce or audit tagging policies across all resource types.

Memory tip: Think of AWS Config as a continuous compliance auditor - if the question mentions "policy enforcement," "drift detection," or "identify non-compliant resources," Config is almost always the answer. The word "continually" in the question is a strong signal pointing away from one-time tools and toward Config's real-time monitoring capability.

No community discussion yet for this question.