Q13 — AWS SAA-C03 Ch.15

Question 13 of 100 | ← Chapter 15

Q1113. A company runs production workloads in its AWS account. Multiple teams create and maintain the workloads.The company needs to be able to detect changes in resource configurations. The company needs to capture changes as configuration items without changing or modifying the existing resources.Which solution will meet these requirements?

Correct Answer: A. Use AWS Config. Start the configuration recorder for AWS resources to detect changes in resource configurations.

Explanation

To meet the company's requirements for detecting changes in resource configurations without modifying the existing resources, the most suitable solution is:A. Use AWS Config. Start the configuration recorder for AWS resources to detect changes in resource configurations.Here's why:AWS Config: This service is specifically designed to provide a detailed view of the configuration of AWS resources in the company's account. By starting the configuration recorder, AWS Config will automatically capture snapshots of the configurations of AWS resources and record changes as configuration items. Non-Intrusive: AWS Config operates without requiring any changes or modifications to the existing resources. It simply monitors and records changes, allowing the company to maintain its current environment without disruption.Comprehensive: AWS Config can track a wide range of AWS resources and provide a detailed history of changes, enabling the company to effectively detect and analyze configuration changes.Now, let's evaluate the other options:B. Use AWS CloudFormation. Initiate drift detection to capture changes in resource configurations.While AWS CloudFormation drift detection can identify changes to resources that were originally provisioned using CloudFormation templates, it does not provide a comprehensive solution for detecting changes in all AWS resources. Additionally, drift detection operates by comparing the current state of resources to the state defined in the CloudFormation template, which may not align with the company's need to capture changes without modifying resources.C. Use Amazon Detective to detect, analyze, and investigate changes in resource configurations.Amazon Detective is designed for security analysis and incident response, focusing on analyzing and visualizing data from AWS CloudTrail and Amazon GuardDuty to investigate potential security issues. It is not suitable for detecting and capturing changes in resource configurations. D. Use AWS Audit Manager to capture management events and global service events for resource configurations.AWS Audit Manager is a service that helps organizations manage and automate audits of their AWS environments. While it can help with compliance and governance, it is not designed to capture detailed changes in resource configurations in real-time.In conclusion, AWS Config is the most appropriate solution for the company to detect changes in resource configurations without modifying the existing resources. By starting the configuration recorder, the company can effectively capture and analyze changes as configuration items.