Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A retail corporation recently migrated its inventory management system to AWS. The security team must implement a solution to continuously monitor for configuration compliance drifts, such as unencrypted Amazon Elastic Block Store (Amazon EBS) volumes or public Amazon S3 buckets, and receive immediate alerts when unauthorized IAM policy changes occur. Which combination of AWS services should the solutions architect recommend to meet these monitoring and alerting requirements? (Select TWO.)

  1. Enable AWS Config to continuously monitor and record resource configuration changes, evaluating compliance against AWS managed rules.Answer
  2. Configure Amazon EventBridge to detect IAM configuration API events logged in AWS CloudTrail and trigger Amazon Simple Notification Service (Amazon SNS) notifications.Answer
  3. C
    Deploy AWS Shield Advanced to continuously scan and block unauthorized IAM policy updates before they are committed.
  4. D
    Configure a stateless Network ACL rule at the subnet level to intercept, log, and prevent unauthorized IAM API calls.
  5. E
    Use AWS WAF to inspect internal IAM API requests and automatically block any unauthorized configuration changes.

Answer

The correct solution involves enabling AWS Config to monitor and evaluate resource configuration compliance drifts, and configuring Amazon EventBridge to detect IAM configuration API events in AWS CloudTrail to trigger notifications via Amazon Simple Notification Service (Amazon SNS).
AWS Config is the native service designed to track and record AWS resource configurations, evaluating them against rules such as verifying that S3 buckets are private and EBS volumes are encrypted. To alert on security alterations like IAM changes in real time, AWS CloudTrail audits the API logs, and Amazon EventBridge can be configured with a rule matching those API activities to trigger an Amazon SNS topic for instant alert notifications.

Step-by-Step Solution

1
Identify the tool suitable for continuous resource configuration compliance monitoring.
AWS Config is identified as the service that records configurations and evaluates them against custom or managed rules.
AWS Config maintains a configuration history and evaluates resource compliance status (such as identifying public S3 buckets or unencrypted EBS volumes).
2
Determine the service integration necessary to capture IAM API activity and generate real-time alerts.
AWS CloudTrail logs the IAM API actions, Amazon EventBridge matches the specific pattern of those events, and Amazon SNS sends notifications.
This integration enables near real-time event-driven alerting for critical security configuration changes like IAM mutations.

Key Concept

Continuous security configuration auditing and near real-time compliance monitoring on AWS.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic