SCS-C03 Security Foundations and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS Budgets to force tagging.

  Why it's wrong here

  AWS Budgets is designed for tracking spending and sending notifications. It lacks the technical capability to enforce resource tagging or detect missing tags on infrastructure. Tagging governance must be enforced through configuration monitoring services like AWS Config, not through a billing-focused service that monitors cost metrics.

• ✓

  Use AWS Config rules to monitor tagging compliance.

  Why this is correct

  AWS Config is designed for continuous assessment and compliance monitoring. By setting up a 'required-tags' rule, the organization can automatically audit all resources for the presence of the required 'Department' tag, enabling automated reporting and alerting on any resources that fail to meet the company's tagging policy.

• ✗

  Use an IAM policy to prevent resource creation.

  Why it's wrong here

  While IAM policies can restrict actions, they are not effective for enforcing metadata requirements like tags at the time of resource creation for most services. IAM policies govern API calls, but the complex logic required to validate the presence of specific tags on dynamic objects is better handled by Config.

• ✗

  Use AWS Trusted Advisor to tag resources.

  Why it's wrong here

  Trusted Advisor provides recommendations for cost optimization and security; it does not have the capability to automatically apply or enforce tags on resources. Governance requires active monitoring and rule-based enforcement, which Trusted Advisor does not provide in the context of resource-level tagging compliance.