An emergency-management department wants continuous detection of any SageMaker endpoint deployed without encryption at rest, across all of its AI workloads, rather than a one-time manual audit. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
A one-time audit is a snapshot; a continuous rule is a smoke detector. Configuration compliance keeps checking every endpoint against the encryption requirement on an ongoing basis, so drift gets caught the moment it happens instead of at the next scheduled review. That's the difference between checking once and watching always.
Full Explanation
A configuration-compliance service that continuously evaluates resources against a defined rule — in this case, requiring encryption at rest — checks every relevant endpoint on an ongoing basis and flags noncompliant ones as soon as they drift, which matches the emergency-management department's stated need for continuous detection rather than a point-in-time check. A quarterly manual script only catches noncompliant endpoints that existed at the moment it ran, leaving gaps for anything deployed or changed in between audits. A monthly billing report tracks spend, not encryption configuration, and offers no signal about whether a given endpoint is encrypted at rest. A load-balancer health check evaluates response behavior under load, which is unrelated to a resource's encryption settings. Scope caveat: continuous compliance rules only catch what they're explicitly written to check, so confirm the rule's scope actually covers every relevant SageMaker resource type the department uses, not just one. Operational check: intentionally deploy a test endpoint without encryption in a non-production account and confirm the rule flags it within the expected evaluation window.