Ops needs continuous proof that all EBS volumes are encrypted and no security group allows 0.0.0.0/0 on port 22. Which TWO services/features provide this? (Select TWO.)
Choose 2 answers.
A.AWS Config managed rules evaluating resources continuously
Correct. Managed rules like ENCRYPTED_VOLUMES check exactly this.
B.CloudWatch metric filters on application logs
Log filters scan application text, not resource configuration.
C.IAM credential reports generated monthly
Credential reports cover IAM user credentials only.
D.Security Hub aggregating Config and standard findings into a compliance score
Correct. Security Hub rolls findings into auditable compliance posture.
E.S3 access logs
Access logs record S3 requests — unrelated to config compliance.
Why this answer
AWS Config managed rules continuously evaluate resource configurations (encrypted volumes, restricted SSH) and flag violations; Security Hub aggregates those findings into standards-based compliance scores — together covering detection and reporting.
Correct answers: A, D · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Operations practice session.
Practice Security Operations