A healthcare company with 40 accounts under AWS Control Tower must automatically detect unencrypted S3 buckets, public security groups, and drift, then show a unified compliance score to auditors with auto-remediation for critical findings. Which automated compliance monitoring design provides continuous detection and centralized posture visibility?
Select an answer to reveal the explanation.
Short Explanation
Compliance gets easy when rules watch constantly and report in one place. Config plus Security Hub CSPM gives you nonstop posture checks with a single auditor-ready score.
Full Explanation
The correct approach works because AWS Config rules continuously evaluate resource configurations against desired state, conformance packs scale those checks across accounts, and Security Hub CSPM aggregates findings into standardized controls with scores and integrations for automated remediation. GuardDuty with SNS fails by concept because GuardDuty detects malicious behavior and threats, not configuration compliance like encryption or public access drift with posture scoring. Inspector with Automation fails by concept because Inspector finds software vulnerabilities in compute workloads, not broad resource configuration compliance across S3 and networking with centralized scoring. CloudTrail Insights with Athena fails by concept because it analyzes API anomalies retrospectively and manual CSV reports lack continuous evaluation, normalized controls, and native remediation. Exam caveat: map Config to configuration compliance, Security Hub to posture aggregation, GuardDuty to threat detection, and Inspector to vulnerabilities. Practical check: verify Config aggregator coverage, Security Hub control enablement, and that a test unencrypted bucket triggers finding and remediation.