A healthcare technology provider manages patient portals across multiple AWS regions. To satisfy regulatory compliance, the provider must identify unauthorized configuration changes to security groups and detect whether any EC2 instances are communicating with known malicious IP addresses. The provider requires a solution that centralizes these security findings and automates threat detection without impacting application performance. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)
- Enable Amazon GuardDuty in the target regions to analyze VPC Flow Logs and DNS query logs for identifying communications with malicious IP addresses.Answer
- Enable AWS Config to continuously monitor and record configuration changes of VPC security groups to track compliance.Answer
- CDeploy AWS Shield Standard at the subnet level to monitor and filter Layer 7 traffic for unauthorized configuration modifications and malicious IP patterns.
- DConfigure stateless Network ACLs on all subnets to automatically track outbound connections statefully and block threat traffic dynamically.
- EStore third-party security scanner API tokens as plain String parameters in Systems Manager Parameter Store to authorize the threat monitoring service.
Answer
The solutions architect should recommend enabling Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs, and enabling AWS Config to monitor and record changes to VPC security groups.
To detect unauthorized changes to security groups, AWS Config is the appropriate tool because it continuously monitors and records configuration details. To detect traffic to known malicious IPs without affecting performance, Amazon GuardDuty is the correct tool because it analyzes metadata from sources like VPC Flow Logs and DNS logs in an isolated plane.
Step-by-Step Solution
Key Concept
Continuous security monitoring using AWS Config for resource changes and Amazon GuardDuty for intelligent, out-of-band threat detection.
Estimated Time:2m 0s