SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS Config with the managed rule 'ec2-instance-detailed-monitoring-enabled' and configure an automatic remediation action using AWS Systems Manager Automation to enable detailed monitoring on non-compliant instances.

  Why this is correct

  AWS Config's managed rule 'ec2-instance-detailed-monitoring-enabled' runs continuous evaluations against all recorded EC2 instances, marking any without detailed monitoring as non-compliant. Pairing this with an automatic remediation action leverages an AWS Systems Manager Automation document to run the 'ec2-monitor-instances' command or equivalent, enabling detailed monitoring without manual intervention. Because AWS Config already discovers and tracks instances, this solution covers both newly launched and pre-existing instances, requiring no custom code and providing a fully managed, auditable compliance enforcement loop.

• ✗

  Use AWS Trusted Advisor to check for instances without detailed monitoring and send a notification to the administrator via email.

  Why it's wrong here

  AWS Trusted Advisor does offer checks for underutilized or improperly monitored resources, but its architecture is advisory only—it cannot perform changes on your behalf. At best, you could subscribe to email notifications or refresh the check periodically, but the administrator would still need to manually enable detailed monitoring on each flagged instance. This makes it a detection and alerting mechanism, not a policy enforcement mechanism, so it falls short of the requirement to enforce a policy that all instances have detailed monitoring.

• ✗

  Use an Amazon CloudWatch Events rule to detect RunInstances API calls and trigger a Lambda function that enables detailed monitoring on newly launched instances.

  Why it's wrong here

  An Amazon CloudWatch Events rule (now Amazon EventBridge) that matches RunInstances API calls and invokes a Lambda function can enable detailed monitoring on new instances, but this approach has significant gaps. It requires you to write and maintain custom Lambda code, handle IAM permissions and potential race conditions, and it only addresses instances launched after the rule is deployed—existing non-compliant instances remain untouched. In contrast, AWS Config's managed rule with SSM Automation remediation immediately evaluates the entire current instance inventory and automatically fixes non-compliance with no custom development, making it operationally simpler and more complete.

• ✗

  Use an IAM policy that denies the ec2:RunInstances action unless the user specifies the parameter to enable detailed monitoring.

  Why it's wrong here

  IAM policies cannot enforce a requirement that users pass the 'Monitoring' parameter with a value of 'true' when calling ec2:RunInstances, because no IAM condition key exists for that specific request parameter. Even if such a condition key existed, this approach would only affect new instance launches; it would do nothing for instances already running without detailed monitoring or for instances whose monitoring setting is changed after launch. Consequently, this option fails both as a preventive control and as a corrective control, whereas AWS Config can continuously detect and remediate any drift.

Go deeper

Related to this question