ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Organizations with multiple accounts and wants to centrally manage VPC security group rules. They need to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which service should they use to automatically detect and remediate noncompliant security groups?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config with managed rules like restricted-ssh can detect noncompliant security groups, and AWS Config remediation actions can automatically remediate them. AWS Firewall Manager can also centrally manage security group rules across accounts, but it is more about enforcement and policy management. Option A is correct because AWS Config is the primary service for compliance monitoring and remediation. Option C (AWS Firewall Manager) is also a valid service but is more for policy-based management across accounts; however, the question asks for detection and automatic remediation, which AWS Config does directly. Option D (AWS CloudTrail) is for auditing API calls, not for enforcement. Option B (Amazon GuardDuty) is for threat detection, not security group compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config can evaluate security group rules against desired configurations and trigger automatic remediation via AWS Systems Manager Automation.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty detects threats using anomaly detection, not security group compliance.
- ✗
AWS Firewall Manager
Why it's wrong here
AWS Firewall Manager centrally manages security group rules across accounts, but it does not automatically detect and remediate noncompliant rules; it enforces policies at creation time.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API calls but does not detect or remediate security group compliance.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team wants to enforce that no security group allows inbound SSH (port 22) from 0.0.0.0/0. Which policy type should be used?
medium- A.Network ACL
- B.IAM policy
- ✓ C.Service Control Policy (SCP)
- D.AWS Config rule
Why C: The Service Control Policy (SCP). SCPs are used in AWS Organizations to centrally control the maximum available permissions for all accounts in an organization. They can be used to prevent security groups from allowing inbound SSH from 0.0.0.0/0 by denying the ability to create or modify security group rules that permit such traffic. Network ACLs (Option A) operate at the subnet level and are not account-wide; they control traffic entering/exiting subnets, but cannot enforce organizational policies across multiple accounts. IAM policies (Option B) apply to users, groups, or roles, and cannot directly restrict security group configurations. AWS Config rules (Option D) are detective controls that can evaluate compliance but are not preventive; they do not block the creation of non-compliant security group rules. Therefore, SCP is the appropriate preventive policy type.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.