SCS-C03 Security Foundations and Governance Practice Question
A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Audit Manager and AWS Artifact are the primary services for governance and compliance evidence management. Audit Manager automates the process of gathering evidence from various AWS services to assess compliance with frameworks. AWS Artifact provides a central repository for on-demand access to AWS’s own security and compliance reports, which are essential for satisfying external auditors' requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the go-to central resource for compliance-related information. It provides on-demand access to AWS's security and compliance reports, such as SOC, PCI, and ISO certifications. Auditors require these documents to verify that the underlying AWS infrastructure meets the necessary regulatory standards and security controls for the organization.
- ✓
AWS Audit Manager
Why this is correct
AWS Audit Manager simplifies the audit process by continuously and automatically collecting evidence to help assess your risk and compliance. It maps your AWS resources to the requirements of frameworks like SOC 2 or HIPAA. This reduces the manual effort of gathering configuration data and provides a consolidated report for auditors.
- ✗
AWS Security Hub
Why it's wrong here
Security Hub provides a comprehensive view of security alerts and security posture across AWS accounts. While it conducts automated security checks against best practices and standards like CIS, it is primarily a detective service. It does not provide official AWS compliance reports or manage the formal evidence collection process for audits.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API calls and user activity across your AWS infrastructure, providing a detailed log of events. While these logs are vital for forensic analysis and can serve as raw evidence during an audit, CloudTrail itself does not organize evidence into compliance frameworks or provide formal compliance reports for auditors.
- ✗
AWS Trusted Advisor
Why it's wrong here
Trusted Advisor provides recommendations to help follow AWS best practices in categories like cost optimization and security. Although it checks for security gaps like open ports, it is not designed to track compliance against specific regulatory frameworks or provide the structured evidence reports required for a SOC 2 audit.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.