Config quiz · Level 0 · Todo.io Learns AWS

Question 1A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 2Todo.io wants to see how a security group's rules looked last Tuesday, and every change since. Which service shows that?

AWS Config.Correct. Config keeps a history of each resource's settings.AWS CloudTrail.Not this one. CloudTrail shows each call that changed it, not a picture of the settings at a point in time.Amazon CloudWatch Logs.Not this one. Logs hold app output.IAM Identity Center.Not this one. Identity Center handles sign-in.

Learn it: AWS Config

Question 3A Config rule checks that no S3 bucket is public. A teammate makes a bucket public. Does the rule stop it?

No. Config reports the bucket as noncompliant after the change; it doesn't block it.Correct. Config is detective. You can attach a remediation that fixes it afterwards, but blocking needs a preventive control such as an SCP.Yes. Config rules block changes that break them.Not this one. Config evaluates after the fact.Yes, by deleting the bucket.Not this one. Config never deletes resources on its own.Only if CloudTrail is turned off.Not this one. CloudTrail has nothing to do with it.

Learn it: AWS Config · Control Tower controls

Question 4What does an AWS Config rule mark each resource it checks as?

Compliant or noncompliant.Correct. The result shows on the Config (and Control Tower) dashboards.Allowed or denied.Not this one. That is how IAM answers requests.Public or private.Not this one. That is one thing a rule might check, not what it marks.Healthy or unhealthy.Not this one. That is how load balancers describe targets (Level 2).

Learn it: AWS Config

Question 5AWS Config shows that a bucket became public at 14:02. Where should Todo.io look to find out who did it?

CloudTrail, for the call that changed the bucket around 14:02.Correct. Config says what changed and when; CloudTrail says who made the call.AWS Config again; it records the caller.Not this one. Config records the resource's settings, not the caller.CloudWatch Logs.Not this one. App output won't show who called S3.The bucket's object list.Not this one. Objects don't record who changed the bucket's settings.

Learn it: AWS Config · CloudTrail

Question 6What are Control Tower's detective controls built from?

AWS Config rules.Correct. They spot problems after they happen and report them.Service control policies.Not this one. SCPs are the preventive controls.CloudFormation hooks.Not this one. Hooks are the proactive controls.IAM policies in each account.Not this one. Controls are applied across OUs, not written into each account's IAM.

Learn it: AWS Config · Controls (guardrails)

Question 7Todo.io's auditors want ongoing evidence that every EBS volume is encrypted. What provides it?

An AWS Config rule that checks volume encryption, with its compliance history.Correct. Config keeps checking and keeps the record auditors need.CloudTrail Event history.Not this one. It shows calls, not whether every volume is encrypted right now.An SCP.Not this one. An SCP could block unencrypted volumes, but it produces no evidence about existing ones.A spreadsheet updated by hand.Not this one. Out of date the moment anything changes.

Learn it: AWS Config

Question 8Which requirement points to AWS Config rather than an SCP?

"Report on any resource that isn't tagged with its owner."Correct. "Report on", "find out when" and "show evidence" are detective words: Config."It must never be possible to disable CloudTrail."Not this one. "Must never" asks for a preventive control: an SCP."Block any request outside approved Regions."Not this one. Blocking is preventive."Prevent anyone from leaving the organization."Not this one. Preventing is preventive.

Learn it: Controls (guardrails)

Question 9What does AWS Config record?

Each resource's configuration, and how it changes over time.Correct. A timeline of what each resource looked like.Only who made each API call.Not this one. That is CloudTrail.Application log lines.Not this one. That is CloudWatch Logs.Every network packet.Not this one. Config doesn't see traffic.

Learn it: AWS Config

Question 10Todo.io turned on AWS Config in us-east-1 only. Resources in eu-west-1 aren't being recorded. Why?

Config records per Region; it has to be turned on in every Region Todo.io uses.Correct. Control Tower does this for you in the Regions it governs.Config is global, so this must be a bug.Not this one. Config is regional.Config doesn't work in eu-west-1.Not this one. It works in every commercial Region.Config needs CloudTrail to be on first.Not this one. They are separate services.

Learn it: AWS Config · Region

Question 11Todo.io wants one view of compliance across all its accounts and Regions. What gives that?

A Config aggregator (for example in the Audit account) that collects results from every account and Region.Correct. One place to see what is noncompliant anywhere.Signing in to each account and Region in turn.Not this one. It works, but it is slow and easy to miss something.CloudTrail Event history.Not this one. It shows API calls, not compliance.IAM Identity Center.Not this one. It handles sign-in, not compliance.

Learn it: AWS Config

Question 12What does "AWS Config" mean?

Records how your resources are configured over time and checks them against rules.Correct. Think of it as: A building inspector with a notebook and a camera.A record of every AWS API call. Who did what, when, from where.Not this one. That describes CloudTrail.Where applications and AWS services send their log lines.Not this one. That describes CloudWatch Logs.A managed queue. One part of your system drops messages in, another takes them out later.Not this one. That describes SQS (Simple Queue Service).

Learn it: AWS Config

Question 13Which term is this? "Records how your resources are configured over time and checks them against rules."

AWS ConfigCorrect. Yes. Think of it as: A building inspector with a notebook and a camera.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines.SQS (Simple Queue Service)Not this one. SQS (Simple Queue Service) is: A managed queue. One part of your system drops messages in, another takes them out later.

Learn it: AWS Config

Question 14Which AWS term is described by this analogy? "A building inspector with a notebook and a camera."

AWS ConfigCorrect. Yes: Records how your resources are configured over time and checks them against rules.CloudTrailNot this one. CloudTrail is: A record of every AWS API call. Who did what, when, from where. Its analogy: The building's CCTV and visitor book.CloudWatch LogsNot this one. CloudWatch Logs is: Where applications and AWS services send their log lines. Its analogy: The building's logbook.SQS (Simple Queue Service)Not this one. SQS (Simple Queue Service) is: A managed queue. One part of your system drops messages in, another takes them out later. Its analogy: A ticket rail in a restaurant kitchen. Waiters clip orders up, cooks take them down when ready.

Learn it: AWS Config

Config

Worth another look

Your weak spots

Services

Concepts