SCS-C03 Security Foundations and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Trusted Advisor

  Why it's wrong here

  Trusted Advisor provides checks for best practices, but it does not offer a comprehensive mapping to the CIS AWS Foundations Benchmark. Its security checks are more generalized (e.g., public S3 buckets). Security Hub is the specialized service intended for measuring compliance against industry-standard benchmarks like CIS.

• ✓

  AWS Security Hub

  Why this is correct

  Security Hub is the primary tool for evaluating compliance with security standards. It automatically runs continuous checks against the CIS AWS Foundations Benchmark and other standards. It aggregates these results into a single dashboard, providing a clear compliance score and actionable findings for the entire AWS Organization.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is the underlying engine that Security Hub uses for many of its checks. However, Config itself provides raw configuration data and individual rule results. Security Hub provides the higher-level governance dashboard and the specific 'Standard' packs (like CIS) that organize those rules into a meaningful compliance framework.

• ✗

  AWS Artifact

  Why it's wrong here

  AWS Artifact is a portal for downloading compliance reports (like SOC and ISO) regarding the AWS infrastructure itself. It does not monitor or audit the customer's own resource configurations within their accounts. For auditing customer-managed resources against benchmarks like CIS, Security Hub must be used.