SAP-C02 Question 217

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  AWS Config is purpose-built to track security group changes in real time against compliance rules and can directly send alerts through SNS. B (CloudTrail + CloudWatch) only tells you who changed what, not if it’s compliant. A and C misuse SCPs, which don’t track or alert on security group changes. For the exam, when you see “track + alert on compliance changes,” think AWS Config first.

• Chose B1

  B is faster

• Chose D3

  Both B and D works. But the question is asking for FASTEST. For cloudTrail, you need: CloudTrail → CloudWatch Logs → CloudWatch Metric Filter → CloudWatch Alarm → SNS Notification For aws Config, it natively support integration with SNS. Hence we should choose D