What's changed: Deepened SCS-C02 Chapter 6 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
6.2Configuration Compliance and Auto-Remediation
Understand continuous compliance—AWS Config (rules/conformance packs), auto-remediation, Security Hub standards, Audit Manager, and Systems Manager. Continuously assess compliance and auto-fix drift.
Compliance is continuously assessed and corrected. AWS Config evaluates rules and auto-remediates drift.
6.2.1Compliance automation
- AWS Config: continuously evaluate configuration against rules, detecting drift (public S3, missing encryption).
- Auto-remediation: attach remediation actions (SSM Automation) to Config rules to auto-fix drift.
- Security Hub standards/conformance packs: score and bundle CIS/AWS Foundational Best Practices.
- Audit Manager: continuously collect audit evidence to support compliance reports.
Common on SCS-C02: continuous config compliance = AWS Config (rules/conformance packs), auto-fix drift = Config remediation/SSM Automation, best-practice scoring = Security Hub standards, audit evidence = Audit Manager. "Detect public S3 → auto-make private" is a classic Config rule + remediation.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.