Examkin

Question

Difficulty: EasySecurity Monitoring and Threat Detection

A retail company wants to implement automated security monitoring and compliance tracking for its AWS infrastructure. The security team requires that all Amazon S3 buckets must have server-side encryption enabled, and Amazon EC2 security groups must not allow inbound SSH traffic from the public internet (0.0.0.0/0). Any non-compliant resources must be detected automatically, and the team must receive real-time alerts.

Which TWO solutions should a solutions architect implement to meet these requirements?

  1. Enable AWS Config and deploy the managed rules for S3 bucket encryption and restricted SSH ports.Answer
  2. Configure an Amazon EventBridge rule triggered by AWS Config compliance state changes to send alerts via Amazon Simple Notification Service (Amazon SNS).Answer
  3. C
    Deploy AWS Shield Advanced to continuously scan and block non-compliant S3 configurations and automatically update Security Groups at the network edge.
  4. D
    Configure a stateless Network ACL rule at the subnet level to block all port 22 traffic and automatically encrypt incoming traffic to S3 buckets.
  5. E
    Store the security compliance status as plaintext in Systems Manager Parameter Store and run a cron job on EC2 to send notifications.

Answer

Enable AWS Config with managed rules for S3 encryption and restricted SSH ports, and configure an Amazon EventBridge rule to route compliance change events to Amazon SNS.
The correct options involve enabling AWS Config to deploy managed rules for evaluating S3 encryption and restricted security group ports, alongside configuring Amazon EventBridge to route compliance change alerts via Amazon SNS. This aligns with AWS security monitoring best practices for automated compliance auditing and near real-time notification.

Step-by-Step Solution

1
Enable configuration recording in AWS Config for the required resources.
AWS Config begins tracking configuration history and changes for Amazon S3 and EC2 security groups.
This establishes the data source for compliance monitoring.
2
Deploy AWS Config managed rules for S3 bucket encryption verification and restricted SSH port checks.
AWS Config automatically evaluates resources against these rules and marks non-compliant resources.
Managed rules automate compliance auditing without writing custom logic.
3
Create an Amazon EventBridge rule that filters for AWS Config compliance change events.
Events are captured whenever a resource transitions from compliant to non-compliant status.
This triggers the notification workflow when compliance status changes.
4
Configure the EventBridge rule target to publish messages to an Amazon SNS topic.
Alerts are sent to subscribers of the SNS topic immediately upon compliance status changes.
This meets the real-time alerting requirement.

Key Concept

Continuous compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic