DOP-C02 Practice Question 13: Organization Conformance Pack
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 2 · question 3 of 10
An organization has about 300 AWS accounts, and AWS Config recording is already on in every account and Region in use. The security team wants a standard set of Config rules for Amazon S3 bucket settings, each paired with an automatic remediation action, to run in every member account. The set must be managed centrally from the security team's delegated administrator account, must reach accounts that join the organization later with no extra work, and must not be modifiable or deletable by administrators of the member accounts.
Which approach meets these requirements?
Show answer and explanation
Answer:
A conformance pack is a collection of Config rules and remediation actions deployed as one unit, authored as a YAML template. Deployed at the organization level with PutOrganizationConformancePack from the management account or a delegated administrator, it meets each constraint. It deploys the rules and remediation actions to every member account. The AWS Config docs state that the management account can ensure the underlying rules and remediation actions "are not modifiable by your organization's member accounts". And "if a new account joins an organization, the rule or conformance pack is deployed to that account". The prerequisite, Config recording already on, is given in the stem.
Option B delivers the resources and follows new accounts, but the rules it creates are ordinary stack resources in each member account. A member administrator can edit or delete them unless you add extra guardrails, so the "not modifiable" requirement is not met on its own terms. Organization conformance packs exist to provide exactly that enforcement.
Option C confuses visibility with deployment. An aggregator gathers configuration and compliance data from many accounts into one read-only view. It does not deploy rules to member accounts, and remediation actions are configured on rules inside each account, not on aggregated findings.
Option D is detection without the stated remediation. A Security Hub standard evaluates controls and produces findings, but it does not attach the automatic remediation actions the stem asks for, and the rule set is whatever the standard defines rather than the security team's own list.
References: Conformance Packs for AWS Config; Managing Conformance Packs for AWS Config Across all Accounts in Your Organization