Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

An enterprise logistics company runs a fleet of Amazon EC2 instances in a private subnet to process shipping telemetry. The security team must design a threat detection and mitigation system to identify any EC2 instances that attempt to communicate with known malicious command-and-control (C&C) servers. When a threat is detected, the system must immediately block both inbound and outbound communication with the malicious IP address for the affected subnet. Which architectural design meets these requirements while adhering to the AWS Well-Architected Framework?

  1. Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.Answer
  2. B
    Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds an outbound DENY rule for the remote IP address to the Security Group associated with the EC2 instances in the private subnet.
  3. C
    Enable AWS Shield Advanced on the resources in the private subnet. Configure AWS Shield Advanced to automatically detect the malicious outbound traffic and update the subnet's route table to redirect traffic destined for the remote IP address to a blackhole route.
  4. D
    Enable AWS WAF on the elastic network interfaces (ENIs) of the EC2 instances in the private subnet. Configure AWS WAF to inspect the outbound traffic payloads and block all packets destined for the malicious IP address.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.
The correct architecture uses Amazon GuardDuty to detect the malicious outbound C&C traffic by analyzing VPC Flow Logs. The event triggers an EventBridge rule that invokes an AWS Lambda function. The Lambda function adds inbound and outbound DENY rules to the stateless Network Access Control List (NACL) associated with the private subnet, which effectively blocks the communication at the subnet boundary as required.

Step-by-Step Solution

1
Select the appropriate security monitoring and threat detection service.
Amazon GuardDuty is enabled. It continuously monitors VPC Flow Logs, DNS logs, and CloudTrail management events to identify anomalous and malicious behaviors such as C&C communications.
Threat detection at the network layer for C&C server communication requires machine learning-based intelligence and signature matching, which GuardDuty provides out-of-the-box using VPC Flow Logs.
2
Configure real-time event routing for automated response.
An Amazon EventBridge rule is created to match GuardDuty findings (specifically those indicating outbound C&C communication) and target an AWS Lambda function.
EventBridge enables event-driven automation in response to security findings within seconds of detection.
3
Implement the blocking mechanism at the subnet level.
The AWS Lambda function modifies the Network Access Control List (NACL) of the target private subnet to add inbound and outbound DENY rules targeting the malicious IP address.
To block traffic at the subnet boundary, stateless NACLs must be used because Security Groups do not support DENY rules. Since NACLs are stateless, separate rules for both inbound and outbound traffic are required to fully isolate the subnet from the malicious destination.

Key Concept

Security Monitoring, Automated Threat Detection, and Subnet-Level Network Security Controls
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic