Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A software-as-a-service (SaaS) company hosts a multi-tier web application on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances. The security team needs to monitor the environment for Layer 7 web exploits, detect anomalous network activity or potential credential compromise at the host level, and continuously audit changes to network access controls. Which combination of AWS services should a solutions architect recommend to meet these monitoring and threat detection requirements? (Select TWO.)

  1. Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, and enable AWS Config to track and audit configuration history for security groups.Answer
  2. Enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.Answer
  3. C
    Deploy AWS Shield Advanced on the ALB to analyze and block Layer 7 web application exploits, and configure AWS Config to audit subnet-level stateful traffic patterns.
  4. D
    Configure stateless Security Groups at the subnet level to log traffic, and store threat detection alert credentials in Systems Manager Parameter Store as plain String parameters.
  5. E
    Deploy AWS Shield Standard on the ALB to monitor and log SQL database queries, and store monitoring API tokens in Systems Manager Parameter Store as plain String parameters.

Answer

Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, enable AWS Config to track and audit configuration history for security groups, and enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.
The correct combination uses AWS WAF for inspecting and blocking Layer 7 web exploits, AWS Config to record configuration changes for security groups to audit network access controls, and Amazon GuardDuty to analyze VPC Flow Logs and CloudTrail events to identify network anomalies and potential compromises.

Step-by-Step Solution

1
Address the requirement for Layer 7 web exploit mitigation.
Identify AWS WAF as the correct service to deploy on the ALB, as it filters and blocks Layer 7 application-specific attacks.
AWS WAF provides deep inspection of HTTP/HTTPS requests, which is required to prevent common web exploits.
2
Address the requirement for host-level anomalous network activity and threat detection.
Identify Amazon GuardDuty as the appropriate service, which uses intelligent threat detection to analyze VPC Flow Logs and CloudTrail events.
GuardDuty monitors logs in the background without affecting performance to detect anomalies, brute-force attempts, and credential misuse.
3
Address the requirement for auditing network access configuration modifications.
Identify AWS Config to continuously track, record, and evaluate configuration changes to security groups.
AWS Config is the primary service for resource configuration history and compliance auditing.

Key Concept

Selecting the appropriate AWS services for Layer 7 security (WAF), threat detection (GuardDuty), and compliance tracking (AWS Config) according to the AWS Well-Architected Framework.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic