AWS Config for compliance - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How AWS Config evaluates compliance

When AWS Config evaluates a resource against a rule, what determines if the resource is marked as compliant?

A The resource is in the same AWS region as the Config service.

B The resource is tagged with 'compliant' by the user manually.

C The resource matches the rule's criteria and passes all evaluations.

D The resource has no changes recorded in the last 24 hours.

💡 Hint

Think about how AWS Config rules check resource settings automatically.

AWS Config marks a resource as compliant only if it meets the conditions defined in the rule during evaluation. Manual tagging or region alone does not affect compliance status.

❓ Architecture

intermediate

Designing AWS Config for multi-account compliance

You want to monitor compliance across multiple AWS accounts in your organization. Which AWS Config setup allows centralized compliance management?

A Use AWS Config aggregator in a designated account to collect compliance data from all member accounts.

B Enable AWS Config separately in each account without aggregation.

C Use CloudTrail to monitor compliance events across accounts.

D Create IAM roles in each account and manually check compliance.

💡 Hint

Think about a way to see all compliance data in one place.

AWS Config aggregator collects compliance and configuration data from multiple accounts and regions into one account for centralized viewing and analysis.

❓ security

advanced

Securing AWS Config data access

Which IAM policy condition best restricts AWS Config data access to only users connecting from your corporate network's IP range?

A "Condition": {"StringEquals": {"aws:username": "corp-user"}}

B "Condition": {"DateGreaterThan": {"aws:CurrentTime": "2024-01-01T00:00:00Z"}}

C "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}

D "Condition": {"IpAddress": {"aws:SourceIp": ["203.0.113.0/24"]}}

💡 Hint

Restrict access based on IP addresses.

The IpAddress condition with aws:SourceIp limits access to requests coming from specified IP ranges, such as your corporate network.

✅ Best Practice

advanced

Optimizing AWS Config rule evaluations

You notice AWS Config rule evaluations are causing high costs. Which approach best reduces unnecessary evaluations?

A Disable AWS Config in all regions except one.

B Configure rules to trigger evaluations only on configuration changes instead of periodic checks.

C Increase the frequency of periodic evaluations to catch issues faster.

D Delete all custom rules and use only AWS managed rules.

💡 Hint

Think about when rules run evaluations.

Triggering evaluations only on configuration changes reduces the number of rule runs and lowers costs compared to frequent periodic evaluations.

🧠 Conceptual

expert

Understanding AWS Config compliance timeline

After enabling AWS Config and a custom rule, you notice some resources show non-compliant immediately, even though they meet the rule criteria. What is the most likely reason?

A AWS Config has not completed the initial full evaluation of all resources yet.

B The resources are in a different AWS region than the rule.

C The rule is disabled but still showing old compliance data.

D The resources are tagged incorrectly.

💡 Hint

Think about how AWS Config processes initial data.

When AWS Config and rules are first enabled, it takes time to evaluate all resources. Until then, some resources may temporarily show non-compliant.