A security operations team wants continuous compliance checks for AWS resources. They need to know when an EBS volume becomes unencrypted or when a security group starts allowing SSH from 0.0.0.0/0. Which AWS service should they use?

AWS CloudTrail, because it records every API call made in the account.

CloudTrail is excellent for auditing API activity, but it does not evaluate resource compliance states by itself.

Amazon GuardDuty, because it automatically encrypts noncompliant resources.

GuardDuty detects threats and anomalies, but it does not evaluate or remediate configuration compliance.

Amazon Macie, because it manages encryption settings for all AWS resources.

Macie specializes in discovering and classifying sensitive data in S3, not in evaluating general resource configuration compliance.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: AWS Config, because it evaluates resource configuration against compliance rules. — AWS Config is designed to assess configuration state continuously and compare resources against desired rules. That makes it ideal for detecting noncompliant settings like unencrypted EBS volumes or security groups that expose SSH to the world. It provides a compliance view over time, which is exactly what operations and security teams need for governance and drift detection. Why others are wrong: CloudTrail records API activity but does not determine whether the resulting configuration is compliant. GuardDuty focuses on threat detection, not compliance evaluation. Macie is for sensitive data discovery in S3 and is not the right tool for checking EBS encryption or security group exposure.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.