SCS-C02 Management and Security Governance Practice Question
A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?
⚠ Common exam trap
Test-takers frequently confuse notification-based responses (like SNS or CloudWatch Events) with actual automated remediation, forgetting that AWS Config's native remediation actions are limited to Lambda functions and Systems Manager Automation documents, not generic event-driven workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure AWS Config rules to invoke an AWS Lambda function for remediation
AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure AWS Config rules to invoke an AWS Lambda function for remediation
Why this is correct
AWS Config rules can be directly associated with remediation actions, and invoking a Lambda function is a fully supported native option. Lambda enables custom code to evaluate and automatically fix non-compliant resources, such as updating security group rules or stopping an instance, based on the rule's evaluation result. This makes it one of the two built-in remediation targets available without needing external services.
- ✗
Configure AWS Config rules to send notifications to an SNS topic
Why it's wrong here
An SNS topic receives notifications from AWS Config rule evaluations, but SNS is a pub/sub messaging service that simply delivers the message to subscribers and performs no compute or modification actions. While useful for alerting administrators to non-compliance, it cannot change or repair the underlying resource, so it does not qualify as a remediation mechanism. Any actual fix would have to be implemented separately, such as by a Lambda function subscribed to the topic.
- ✓
Use AWS Systems Manager Automation documents as remediation actions
Why this is correct
AWS Config natively supports Systems Manager Automation documents as remediation actions, allowing you to run prebuilt or custom runbooks that execute one or more steps to restore compliance. These runbooks can include parallel branches, error handling, and manual approval gates, making them ideal for standardized, repeatable fixes across many resources. Like Lambda, SSM Automation is a first-class remediation target in the AWS Config console.
- ✗
Use AWS CloudTrail to log non-compliant events
Why it's wrong here
CloudTrail records all API calls and activity in your account, offering an immutable audit log, but it is a passive logging service with no ability to assess resource compliance against AWS Config rules or to execute corrective changes. Its purpose is to answer 'who did what,' not to detect or fix configuration drift. Therefore, configuring CloudTrail would only give you a trail of what happened, not an automated remediation action.
- ✗
Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine
Why it's wrong here
Amazon CloudWatch Events (now EventBridge) can trigger a Step Functions state machine when it detects a rule event, and Step Functions can orchestrate workflow steps. However, this is not a native AWS Config remediation action and requires you to design the state machine's tasks—typically invoking Lambda or Systems Manager—to actually change the resource. Without that additional setup, the state machine merely coordinates and does not directly remediate, so this option is an indirect custom workflow rather than a built-in remediation mechanism.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.