Examkin

Question

Difficulty: Very hardSecurity Monitoring and Threat Detection

A financial services company hosts a high-frequency trading application on Amazon EC2 instances inside a private subnet of a VPC. A security architect needs to implement a threat detection and automated remediation system to identify and block outbound command-and-control (C2) traffic from these instances. The solution must immediately block outbound traffic to the identified malicious IP addresses at the subnet boundary to prevent data exfiltration, while ensuring that the rest of the legitimate application traffic in the subnet continues to flow without interruption. Which architecture should the security architect implement to meet these requirements with the lowest operational overhead?

  1. Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.Answer
  2. B
    Deploy AWS WAF on the Application Load Balancer and enable AWS Shield Advanced. Configure AWS Shield Advanced to inspect outbound traffic from the EC2 instances for C2 signatures, and use AWS WAF to block the destination IP address at the subnet level.
  3. C
    Enable VPC Flow Logs to stream to Amazon CloudWatch Logs. Create a metric filter to detect C2 activity, which triggers an Amazon CloudWatch alarm. The alarm invokes an AWS Lambda function that adds an outbound DENY rule for the malicious IP address to the security group attached to the EC2 instances.
  4. D
    Enable Amazon GuardDuty to monitor the VPC. Configure GuardDuty to trigger an AWS Lambda function via Amazon EventBridge. The Lambda function adds an outbound DENY rule for the malicious IP address to the security group associated with the subnet.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.
The correct architecture utilizes Amazon GuardDuty to monitor network logs natively and trigger an automated EventBridge rule. The triggered Lambda function applies an explicit deny rule in the stateless Network ACL at the subnet boundary. This successfully isolates the outbound C2 communication at the perimeter while keeping other subnet traffic unaffected.

Step-by-Step Solution

1
Detect malicious C2 activity using a native AWS threat detection service.
Amazon GuardDuty is enabled, which natively analyzes VPC Flow Logs and DNS query logs to identify suspicious outbound patterns such as command-and-control server communication.
This avoids custom log parsing and maintains the lowest operational overhead for complex threat detection.
2
Automate threat remediation using EventBridge and Lambda.
An EventBridge rule matches GuardDuty finding types for C2 activity and triggers an AWS Lambda function, passing the metadata of the malicious destination IP.
This establishes a real-time, event-driven orchestration pipeline.
3
Implement the blocking mechanism at the subnet boundary.
The Lambda function updates the Network Access Control List (NACL) associated with the subnet, adding an explicit outbound DENY rule for the specific IP.
Network ACLs operate statelessly at the subnet boundary, allowing targeted blocking of traffic before it leaves the subnet while leaving legitimate traffic to other destinations unaffected.

Key Concept

Automated security threat detection and mitigation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic