You are working as a system administrator in a large financial company. You need to assemble the compliance and security standards of the company, which includes various security, operational, and cost optimization checks in AWS. The checks should include operational best practices for Logging, S3 and EC2. Which of the following is the most suitable to achieve the requirements?

Answer options:

A.Enable AWS Security Hub and also enable the default AWS Foundational Security Best Practices checks for continuous monitoring.
B.Create a custom AWS Config rule with a Lambda function to perform the checks and remediation.
C.Create AWS Config rules and remediation actions with Conformance Packs based on YAML templates.
D.Enable Amazon Macie to establish the required security and non-security company standards. Configure CloudWatch for monitoring and Lambda functions for remediation.

Correct Answer: C
Option A is incorrect because the requirement is to establish security, operational and cost optimization checks. Security Hub focuses on security status, and the AWS Foundational Security Best Practices checks can not cover the security, operational and cost optimization checks.
Option B is incorrect because a single AWS Config rule and a Lambda function would be inappropriate to perform all the checks required for the company. Lambda functions also have an execution time limit. Ideally, it needs multiple AWS Config rules for this task.
Option C is CORRECT because AWS Config Conformance Packs are collections of AWS Config rules and remediation actions that can be easily deployed. AWS provides lots of sample templates, and users can upload their own templates:
Option D is incorrect because Macie is a service to discover sensitive data across all of the organization`s S3 buckets. However, it does not help to perform other security or operational checks.
References:
https://docs.aws.amazon.com/config/latest/developerguide/conformance-pack-console.html,
https://aws.amazon.com/security-hub/faqs/