Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A financial technology company wants to ensure that all Network Access Control Lists (Network ACLs) within their production VPC remain compliant with their security policy, which forbids any inbound rule allowing public access on port 22. The security team needs to detect any configuration changes to Network ACLs in real-time, log the compliance status, and automatically send alerts to an administrator. Which solution meets these requirements with the least operational overhead?

  1. A
    Configure stateless Security Groups at the subnet level to block inbound traffic on port 22, and write a custom script on an Amazon EC2 instance that queries the Security Groups every hour to alert the security team of changes.
  2. B
    Deploy AWS Shield Advanced to automatically inspect all Network ACL rules. Configure Shield Advanced to trigger an alert and block any HTTP requests containing traffic aimed at administrative ports such as port 22.
  3. Use AWS Config to record configuration changes for Network ACLs. Create a managed AWS Config rule to evaluate compliance, and configure an Amazon EventBridge rule to trigger on non-compliant evaluation results to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.Answer
  4. D
    Write a custom AWS Lambda function that retrieves administrative AWS credentials stored as plaintext in Systems Manager Parameter Store. Configure the function to run every minute to query Network ACL configuration APIs and trigger an SNS alert if port 22 is open.

Answer

The correct solution involves utilizing AWS Config to monitor Network ACL resource compliance combined with Amazon EventBridge and Amazon SNS for real-time alerting.
The correct solution leverages AWS Config to monitor resource configuration changes and evaluate compliance against rules. EventBridge triggers notifications via Amazon SNS on non-compliant events. This utilizes fully managed AWS services to achieve real-time monitoring and alerting with minimal operational effort.

Step-by-Step Solution

1
Record Network ACL configuration history using AWS Config.
AWS Config continuously tracks and stores configuration details of Network ACLs in the VPC.
Config tracking is required to detect changes and verify compliance against rules.
2
Create an AWS Config rule to check Network ACL compliance.
Changes that violate the rule (e.g. allowing ingress SSH traffic from 0.0.0.0/0) mark the Network ACL resource as non-compliant.
A compliance rule acts as the monitoring and threat detection mechanism.
3
Configure an Amazon EventBridge rule targeted at AWS Config compliance change events to trigger Amazon SNS.
An email or message is sent automatically to administrators in real-time when compliance changes occur.
This completes the threat detection and alerting pipeline with minimal operational overhead.

Key Concept

Continuous security compliance monitoring and automated alerting using AWS Config, EventBridge, and SNS.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic