Examkin

Question

Difficulty: Very hardSecurity Monitoring and Threat Detection

A retail company operates a multi-tier web application on AWS. The application tier runs on Amazon EC2 instances in a private VPC subnet. A security audit requires the company to monitor network traffic for suspicious activities, such as communication with known malicious command-and-control (C2) servers. If a threat is detected, the company must automatically block all traffic to and from the malicious IP address at the subnet level in near real-time. Which TWO options should a solutions architect combine to meet these requirements with the least operational overhead?

  1. Enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings for malicious network activity.Answer
  2. Configure an Amazon EventBridge rule to match GuardDuty findings, triggering an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.Answer
  3. C
    Deploy AWS Shield Advanced on the EC2 instances' Elastic Network Interfaces (ENIs) to automatically detect traffic anomalies and block them at the network layer.
  4. D
    Configure AWS WAF on the subnet's VPC interface endpoints to inspect all outgoing traffic and block connections to known malicious IP addresses.
  5. E
    Create an AWS Lambda function triggered by Amazon CloudWatch Logs metric filters on VPC Flow Logs to append a deny rule to the stateful Security Groups associated with the EC2 instances.

Answer

The solutions architect should enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings, and configure an Amazon EventBridge rule to match those findings to trigger an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.
To monitor network traffic for threats such as communication with known malicious command-and-control (C2) servers, Amazon GuardDuty is the ideal service. GuardDuty continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail events without impacting network performance or requiring manual logging infrastructure. To automatically block the malicious IP at the subnet level in near real-time, GuardDuty findings can be sent to Amazon EventBridge. An EventBridge rule detects the threat event and triggers an AWS Lambda function. This Lambda function can programmatically add a stateless deny rule to the Network ACL associated with the subnet, which successfully blocks traffic at the subnet boundary as required.

Step-by-Step Solution

1
Identify the monitoring service that can detect command-and-control (C2) network communications with the least operational overhead.
Amazon GuardDuty is selected because it continuously and automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events without requiring log storage configuration or performance impact.
Using native threat intelligence is highly efficient and aligns with the requirement for minimal operational overhead.
2
Choose the network security control to block traffic at the subnet level.
Network Access Control Lists (Network ACLs) are identified as the appropriate control.
Security Groups are applied at the instance level (network interface level) and are stateful, whereas Network ACLs operate at the subnet boundary and support both allow and deny rules.
3
Establish the near real-time automated remediation pipeline.
An Amazon EventBridge rule is configured to detect GuardDuty findings and trigger an AWS Lambda function.
EventBridge provides an event-driven mechanism to respond to GuardDuty findings in near real-time.
4
Implement the programmatic update to the network boundaries.
The AWS Lambda function invokes the Amazon EC2 API to insert a stateless deny rule into the subnet's Network ACL.
This dynamically blocks all traffic to and from the malicious IP address at the subnet level as soon as the threat is identified.

Key Concept

Automated threat detection and network boundary remediation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic