Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

A global financial firm is designing a security monitoring architecture for its multi-account AWS environment managed via AWS Organizations. The firm needs to detect network anomalies, malicious activity, and unauthorized API calls across all accounts, and aggregate these findings into a single dashboard in a dedicated security account. Additionally, they must ensure that any unauthorized modifications of network security configurations, such as security groups and network ACLs, are automatically detected and flagged for compliance auditing. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Enable Amazon GuardDuty across all accounts, designate the dedicated security account as the GuardDuty delegated administrator, and integrate GuardDuty findings with AWS Security Hub in the security account.Answer
  2. Create AWS Config organizational rules to continuously monitor configuration changes of security groups and network ACLs, and aggregate compliance results in the dedicated security account.Answer
  3. C
    Deploy AWS WAF at the VPC subnet level in all accounts to inspect and log inbound and outbound traffic, and stream these logs to Amazon CloudWatch for threat detection.
  4. D
    Configure stateful network ACLs to block malicious IPs flagged by Amazon GuardDuty, and use AWS CloudTrail to capture and analyze real-time network traffic flows.
  5. E
    Enable AWS Shield Advanced on all subnet boundaries to block Layer 7 application exploits, and configure security groups to log stateless packet inspections.

Answer

Enable Amazon GuardDuty across all accounts, designating the security account as the delegated administrator and integrating with AWS Security Hub, while using AWS Config organizational rules to monitor security group and network ACL configurations.
Centralizing threat detection and compliance tracking in a multi-account organization involves using Amazon GuardDuty integrated with AWS Security Hub to monitor activities and logs, combined with AWS Config organizational rules to track changes to resources like security groups and network ACLs.

Step-by-Step Solution

1
Set up centralized threat monitoring using Amazon GuardDuty.
GuardDuty is enabled on all accounts, and the dedicated security account is designated as the delegated administrator, consolidating all security findings in Security Hub.
This establishes real-time network anomaly and malicious API activity detection using VPC Flow Logs, DNS logs, and CloudTrail events without agent deployment.
2
Deploy configuration compliance monitoring using AWS Config.
AWS Config organizational rules are deployed across the organization to monitor resources like Security Groups and Network ACLs.
This automatically tracks any configuration changes to network security resources and flags non-compliance, notifying the security account.

Key Concept

Centralized threat detection and resource configuration compliance auditing in multi-account environments.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic