Compliance Automation Tools (AWS Config, Azure Policy) Questions and Answers for Viva

Answer-1: AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources.

Answer-2: Azure Policy is a governance tool in Microsoft Azure that allows you to enforce organizational standards and assess compliance at-scale.

Answer-3: AWS Config records configuration changes to AWS resources and evaluates them against predefined rules.

Answer-4: Azure Policy evaluates resources for compliance and automatically applies necessary configurations or blocks non-compliant deployments.

Answer-5: A compliance rule in AWS Config defines the desired configuration state of your AWS resources.

Answer-6: Policy definitions specify the conditions under which resources are evaluated and what effect to apply when the condition is met.

Answer-7: Managed rules are pre-built compliance rules provided by AWS that you can use without writing custom code.

Answer-8: A policy initiative is a collection of policy definitions grouped together to track compliance across multiple policies.

Answer-9: No, AWS Config only monitors AWS resources, but you can extend monitoring through custom rules and integrations.

Answer-10: Compliance auditing, security analysis, change management, and operational troubleshooting.

Answer-11: Enforces organizational compliance, automates remediation, and provides visibility into policy compliance.

Answer-12: You can use AWS Lambda to define a custom logic and integrate it with AWS Config.

Answer-13: An effect defines the outcome of the policy evaluation such as "Deny", "Audit", "Append", or "DeployIfNotExists".

Answer-14: A feature that enables you to view resource configuration and compliance across multiple accounts and regions.

Answer-15: It automatically corrects non-compliant resources to bring them back into compliance.

Answer-16: Yes, it can deny deployments that don't meet compliance criteria.

Answer-17: It records all configuration changes and maintains a history to support audits and compliance requirements.

Answer-18: A collection of AWS Config rules and remediation actions that can be deployed together.

Answer-19: Azure Blueprints allow bundling of policies, role assignments, and ARM templates for consistent deployments.

Answer-20: Custom rules use AWS Lambda, which supports languages like Python, Node.js, and Java.

Answer-21: Scope determines which resources, resource groups, or subscriptions the policy applies to.

Answer-22: It supports near real-time monitoring using CloudWatch Events.

Answer-23: Yes, Azure Policy can evaluate and remediate existing resources as well as new ones.

Answer-24: AWS Config tracks changes using configuration items (CIs), which are snapshots of resource configurations.

Answer-25: Yes, AWS Config can trigger Lambda functions or SNS notifications upon non-compliance.

Answer-26: Evaluations can be triggered automatically or manually on a schedule or during deployments.

Answer-27: It is a component that records configuration changes to resources.

Answer-28: Parameters allow you to customize the behavior of policy definitions for different scenarios.

Answer-29: A conformance pack is a collection of compliance rules packaged in a YAML file for easy deployment.

Answer-30: It provides compliance reports showing the percentage of compliant vs. non-compliant resources.

Answer-31: Yes, it integrates with AWS CloudTrail to correlate configuration changes with API activity.

Answer-32: Yes, you can create policies to ensure specific tags are applied to resources.

Answer-33: You can configure retention settings; default is unlimited unless specified.

Answer-34: Using the Azure Portal, Azure CLI, PowerShell, or ARM templates.

Answer-35: Yes, rules can be applied per-region or globally through aggregators.

Answer-36: Yes, using the "DeployIfNotExists" effect, it can deploy configurations automatically.

Answer-37: Through Aggregators and AWS Organizations, AWS Config can evaluate compliance centrally.

Answer-38: A policy alias points to a specific field in a resource's definition used in policy conditions.

Answer-39: Yes, but using AWS Organizations improves central visibility and control.

Answer-40: Through the Azure Policy dashboard or by querying using Azure Resource Graph.

Answer-41: No, it is a paid service with pricing based on the number of configuration items and evaluations.

Answer-42: No native versioning, but you can manage versions manually using naming conventions.

Answer-43: Yes, AWS Config detects and reports drift from desired configurations.

Answer-44: Yes, Terraform can deploy policies using ARM templates or Azure CLI integrations.

Answer-45: Yes, you can stop the configuration recorder to pause tracking temporarily.

Answer-46: Yes, Azure Policy supports AKS through built-in Kubernetes policies.

Answer-47: Using Systems Manager Automation documents linked to specific rules.

Answer-48: Evaluations occur once every 24 hours for existing resources.

Answer-49: Yes, AWS Config includes rules that evaluate IAM configurations for compliance.

Answer-50: Yes, using CI/CD pipelines or GitHub Actions, policies can be deployed and managed from GitHub.