Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A municipal utility company wants to audit its AWS accounts for compliance and threat detection. The security team needs to monitor the environment for unauthorized IAM policy modifications and changes to VPC security groups. Additionally, the team requires near real-time alerts whenever a configuration deviates from the company's security baseline. Which combination of actions should the Solutions Architect recommend to achieve this? (Select TWO.)

  1. Configure AWS Config to continuously record and evaluate configurations of IAM roles, policies, and security groups, and enable AWS CloudTrail in all regions to capture management events.Answer
  2. Create an Amazon EventBridge rule that detects AWS Config non-compliant status changes and specific CloudTrail API calls, and configure it to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.Answer
  3. C
    Deploy AWS Shield Advanced to monitor network traffic to the AWS Management Console and block unauthorized configuration changes made to the console.
  4. D
    Implement stateless Network ACLs at the subnet level to intercept, inspect, and block unauthorized IAM API call requests.
  5. E
    Deploy AWS WAF to inspect console traffic and block API calls destined for the IAM service endpoints if they originate from outside the corporate subnet.

Answer

Configuring AWS Config to continuously record and evaluate IAM and security group resource configurations, enabling AWS CloudTrail in all regions to log management events, and creating an Amazon EventBridge rule to route compliance changes and API alerts to an Amazon SNS topic.
To monitor unauthorized changes and ensure compliance, AWS Config tracks configuration modifications of AWS resources (like IAM policies and security groups) and evaluates them against rules. AWS CloudTrail records API calls and management events across all regions. An Amazon EventBridge rule can ingest these events and trigger actions (like sending an SNS notification) in near real-time when changes are detected.

Step-by-Step Solution

1
Enable AWS CloudTrail across all regions to capture management events and API calls, and enable AWS Config to record resource configurations and evaluate compliance.
Comprehensive log files of all administrative API calls are created, and configuration baselines for IAM resources and security groups are established.
CloudTrail captures the metadata of API calls, while AWS Config tracks how resource configurations change over time.
2
Configure an Amazon EventBridge rule that filters for AWS Config compliance status transitions and CloudTrail API patterns representing unauthorized changes.
Events are captured in real-time and mapped to an event target.
EventBridge enables automated, event-driven responses to system changes.
3
Set the target of the EventBridge rule to an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the security team.
The security team receives push notifications immediately when security configurations drift or unauthorized changes are made.
Amazon SNS provides scalable pub/sub messaging to deliver notifications via email, SMS, or HTTPS webhooks.

Key Concept

Centralized configuration compliance auditing and real-time event-driven alerting using AWS Config, AWS CloudTrail, Amazon EventBridge, and Amazon SNS.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic