Question

A CloudOps engineer is asked to continuously evaluate whether the company's AWS accounts follow established security best practices, such as ensuring root account MFA is enabled and that no security groups allow unrestricted SSH access. Leadership wants a managed set of prescriptive controls with automated pass/fail scoring rather than writing individual detective rules from scratch. Which approach BEST meets this requirement with the least custom development?

Accepted Answer

Enable AWS Security Hub and turn on a managed security standard such as the CIS AWS Foundations Benchmark to run automated control checks and produce compliance scores.

Answer

Create individual AWS Config custom rules backed by Lambda functions for each best-practice check and aggregate the results manually in a dashboard.

Answer

Enable Amazon GuardDuty and rely on its threat findings to determine configuration compliance against best practices.

Answer

Configure CloudTrail data events and query the logs with Athena to detect misconfigured resources on a scheduled basis.