A bank operates 45 accounts under Organizations with strict CIS benchmarks. Auditors require continuous evidence of noncompliant S3, IAM, and KMS configurations with centralized findings and auto-remediation for public buckets. Which governance design provides automated compliance monitoring with Config and Security Hub?
Select an answer to reveal the explanation.
Short Explanation
You need more than spreadsheets to give bank auditors dependable, ongoing evidence. Centralized CSPM with recorded rules helps you monitor compliance and automatically remediate public buckets.
Full Explanation
AWS Config continuously records configurations and evaluates managed CIS-aligned rules for S3, IAM, and KMS; Security Hub CSPM brings those findings together under a delegated administrator for governance across the 45-account organization. Config remediation, using EventBridge automation, can close public buckets to meet the auto-remediation requirement. Config conformance packs and Security Hub enabled separately in each account fail the centralization requirement: isolated findings do not give auditors a unified view or support scalable policy management. Centralized Config and Security Hub with manual ticketing fail the automated-remediation requirement, since human queues cannot ensure immediate containment of public S3 exposure. Delegated Security Hub focused on EC2 fails the scope requirement because it does not evaluate the required S3 public access, IAM policy, and KMS encryption configurations. Exam caveat: configuration compliance evidence is distinct from threat detection and API logging; those do not, by themselves, establish CIS compliance. Practical check: confirm Security Hub is enabled in all required regions under the delegated administrator, the Config aggregator displays compliant and noncompliant resources, and a test public bucket triggers automatic remediation with evidence retained for auditors.