ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS Config continuously records the configuration state of supported AWS resources, stores historical snapshots for as long as you choose, and evaluates each change against rules or conformance packs that map to organizational or regulatory requirements. This enables auditors to verify that resources remained compliant (or to see exactly when they drifted) throughout the requested 12-month period.

• CloudTrail records API calls but not the resulting resource configurations and retains only 90 days of event history by default.
• GuardDuty focuses on threat detection and does not perform configuration compliance checks.
• CloudWatch Logs ingests log data but does not automatically track or evaluate resource configurations. Therefore, AWS Config with conformance packs is the most appropriate choice.