Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A digital media platform hosts its streaming content delivery application on Amazon EC2 instances within a private subnet. The security team needs to implement a solution to monitor the environment for active threats, such as EC2 instances communicating with known command-and-control (C2) servers or performing brute-force attacks. The solution must require minimal operational overhead and provide automatic alerting. Which configuration will meet these requirements?

  1. A
    Deploy AWS WAF at the subnet level to inspect all inbound and outbound traffic for Layer 7 exploits and malicious IP addresses, and trigger alerts using Amazon CloudWatch alarms.
  2. B
    Configure stateless Network ACLs at the subnet level to track stateful outbound connections to command-and-control servers, and use AWS Config to automatically block unauthorized traffic.
  3. Enable Amazon GuardDuty to automatically analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, and configure an Amazon EventBridge rule to route high-severity findings to an Amazon SNS topic for alerting.Answer
  4. D
    Enable AWS Shield Standard to monitor all EC2 instance network interfaces for Layer 7 command-and-control communications, and configure security groups to block the traffic.

Answer

Enable Amazon GuardDuty to automatically analyze AWS CloudTrail management events, VPC Flow Logs, and DNS logs, and configure an Amazon EventBridge rule to route high-severity findings to an Amazon SNS topic for alerting.
The correct solution uses Amazon GuardDuty, which is a managed threat detection service. It continuously analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail management events using machine learning, anomaly detection, and integrated threat intelligence to detect malicious behavior (such as command-and-control communications or brute-force attacks) with minimal operational overhead. Integrating GuardDuty with Amazon EventBridge and Amazon SNS allows the security team to receive automatic alerts for high-severity findings.

Step-by-Step Solution

1
Enable Amazon GuardDuty in the target AWS account.
Amazon GuardDuty immediately begins consuming and analyzing logs including VPC Flow Logs, CloudTrail management events, and DNS query logs without impacting the performance of running EC2 instances.
This establishes the core detection mechanism that leverages built-in threat intelligence and machine learning to identify indicators of compromise, such as command-and-control communications.
2
Configure an Amazon EventBridge rule filtered for GuardDuty findings.
EventBridge detects when a new threat finding is generated by GuardDuty and matches it against the specified filter pattern (e.g., severity level is high).
This provides a serverless event-routing mechanism to automate response workflows.
3
Set the target of the EventBridge rule to an Amazon Simple Notification Service (SNS) topic.
The SNS topic triggers notifications (such as emails or SMS) to the security team upon receiving the matched event from EventBridge.
This completes the automated alerting pipeline with minimal custom code or infrastructure maintenance.

Key Concept

Continuous threat detection and automated alerting using managed security services
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic