DOP-C02 - Security and Compliance (17% of the exam) - Section 6.6

Automate compliance auditing and evidence collection with AWS CloudTrail, AWS Config conformance packs and AWS Audit Manager.

Collect evidence of compliance posture automatically using AWS Audit Manager assessments that map AWS Config conformance pack results to audit frameworks. Rely on AWS CloudTrail organisation trails to produce a tamper-evident log of all API actions across accounts as audit-ready evidence.

AWS CloudTrailAWS Config conformance packsAWS Audit ManagerCompliance reporting

Practice question for this objective

Free sampleSecurity and Compliancemedium

A regulated company runs workloads across 40 member accounts in AWS Organizations and must continuously check that every account satisfies the same set of CIS benchmark controls. The compliance team wants one place to deploy the rule set, have it apply automatically to any new account that joins, and view a single aggregated compliance status. They want to avoid maintaining copies of the rules in each account. Which approach meets these requirements with the least ongoing administration?

AUse an AWS CloudFormation StackSet to deploy individual AWS Config managed rules into each member account and re-run the StackSet manually whenever the organisation onboards a new member account that needs the controls.
BEnable AWS Security Hub in one account and rely on its CIS standard there, asking each member-account team to review their own findings separately in their own Security Hub console whenever an audit is requested.
CDeploy an AWS Config conformance pack as an organisation conformance pack from the delegated administrator account so it applies to all current and future member accounts, then view results through the organisation aggregator. Correct
DWrite an AWS Lambda function that calls the AWS Config API in each account on a schedule, evaluates the CIS controls in custom code, and writes a combined compliance summary to a central Amazon S3 bucket for the team.

Use an organisation AWS Config conformance pack from the delegated administrator to deploy and aggregate a control set across all member accounts automatically. An organisation conformance pack is authored once and deployed by the AWS Config delegated administrator across the whole organisation, automatically including accounts that join later; combined with an organisation aggregator it surfaces a single compliance status, so there is one rule set to maintain rather than a copy per account.

Why A is wrong: A StackSet of per-account rules is tempting because it does push config to many accounts, but it requires re-running on each new account and leaves the rule set duplicated everywhere, which fails the auto-enrol and no-copies requirements.

Why B is wrong: Security Hub does run CIS checks, but enabling it in only one account leaves the other accounts unevaluated and forces per-account manual review, so it neither aggregates organisation-wide status nor auto-enrols new accounts.

Why C is correct: An organisation conformance pack deployed from the delegated administrator is provisioned once, automatically reaches every current and future member account, and its results roll up through an organisation aggregator, meeting the central-deploy and auto-enrol requirements with minimal administration.

Why D is wrong: A hand-built Lambda evaluator can technically read each account, but it duplicates logic AWS Config already provides, needs cross-account credentials and ongoing maintenance, and is far more operational overhead than an organisation conformance pack.

See more DOP-C02 practice questions, answers explained.

Exam traps in Security and Compliance

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

An Amazon EventBridge scheduled rule that lists EC2 instances each hour and checks their tags in an AWS Lambda function, writing any untagged instances it finds at that moment to an Amazon DynamoDB audit table.
Why it is wrong: A scheduled list-and-check Lambda only sees instances at each poll and misses short-lived instances launched and terminated between runs, so it is neither truly continuous nor a reliable historical record compared with Config evaluations.
Create the "AWS Config" rules individually in each account by hand and review the dashboard in every account separately whenever an audit is requested.
Why it is wrong: Manually creating rules per account and reviewing each dashboard is laborious and error-prone, and new accounts get nothing automatically, so it fails both the single-package and auto-onboarding parts of the requirement.
AWS Config with a conformance pack, treating each rule evaluation as the audit evidence and exporting the compliance timeline so the auditor can read the resource configuration history against the controls when needed.
Why it is wrong: AWS Config conformance packs are a strong source of configuration evidence and Audit Manager even ingests them, but Config alone does not map controls to an audit framework or assemble a standard-aligned assessment report for an auditor.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.