Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A financial services company needs to ensure that all Amazon EC2 security groups in its production environment are continuously audited for security compliance. Specifically, any rule that allows inbound traffic from the public internet (0.0.0.0/0) on port 22 must be flagged, and the security team must be notified immediately. Which solution meets these requirements with the least operational overhead?

  1. A
    Configure a stateless Network ACL at the subnet level to block all incoming traffic on port 22, and use VPC Flow Logs to trigger an Amazon SNS notification when a connection is rejected.
  2. B
    Deploy AWS Shield Advanced on the EC2 instances to monitor port 22 traffic, and configure it to automatically remove any security group rules that allow public SSH access.
  3. Enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon Simple Notification Service (Amazon SNS) topic.Answer
  4. D
    Configure Amazon GuardDuty to monitor AWS CloudTrail logs for security group changes, and write a custom AWS Lambda function to revert any changes that allow port 22 access.

Answer

The correct solution is to enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon SNS topic.
AWS Config is designed specifically for tracking resource configuration changes and auditing compliance against rules. The managed rule for restricted SSH access checks security group ingress rules, and EventBridge can publish non-compliant states directly to SNS. This native integration requires no code and minimizes operational overhead.

Step-by-Step Solution

1
Enable AWS Config to record resource configurations.
AWS Config starts tracking configuration changes for resources including EC2 security groups.
This establishes the foundation for monitoring configuration changes and evaluating compliance rules.
2
Deploy the managed rule for restricted SSH access.
AWS Config automatically evaluates security groups against the rule to identify unrestricted port 22 access.
Managed rules provide built-in, low-effort checks for common compliance requirements like securing administrative ports.
3
Configure an EventBridge rule with an SNS target.
Compliance status changes (from compliant to non-compliant) trigger real-time email or SMS alerts to the security team.
This automates notifications to the security operations center without the need to write custom monitoring scripts or Lambda functions.

Key Concept

AWS Config is the primary tool for resource configuration compliance auditing and drift detection, whereas GuardDuty is for active threat detection and Shield is for DDoS mitigation.
Estimated Time:1m 30s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic