Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A financial technology startup recently deployed an application on AWS. The security team needs to establish continuous monitoring of resource configurations to ensure compliance with security standards. Specifically, they must detect when any Security Group allows unrestricted ingress traffic on port 22 or port 3389, and they must automatically remediate these non-compliant configurations by reverting the rules. Additionally, they need to centralize security alerts and compliance statuses across all AWS accounts in the organization. Which combination of AWS services and configurations should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.Answer
  2. Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.Answer
  3. C
    Deploy AWS WAF at the subnet level to inspect inbound traffic and automatically block unauthorized SSH and RDP connection attempts.
  4. D
    Configure stateful Network ACLs (NACLs) at the subnet level to monitor configuration changes and automatically block port 22 and port 3389 traffic.
  5. E
    Enable AWS Shield Advanced to continuously scan security group rules for compliance and automatically rotate security keys when unauthorized ports are open.

Answer

Implement AWS Config rules to monitor and automatically remediate security groups using Systems Manager Automation, and use AWS Security Hub to centralize the aggregated findings across the organization.
AWS Config rules evaluate the configuration settings of AWS resources, detecting open ports in security groups and triggering automated remediation via AWS Systems Manager Automation. AWS Security Hub aggregates compliance data and security findings from AWS Config and other services across the organization into a centralized dashboard.

Step-by-Step Solution

1
Select AWS Config to track Security Group changes and configure automatic remediation.
AWS Config monitors configurations and triggers Systems Manager Automation to revert non-compliant rules.
AWS Config is the primary tool for monitoring configuration compliance, and AWS Systems Manager Automation provides remediation scripts.
2
Select AWS Security Hub to aggregate and centralize alerts.
AWS Security Hub acts as the centralized console to gather findings across the organization.
AWS Security Hub is designed to centralize and prioritize security alerts and compliance statuses across multiple AWS services and accounts.

Key Concept

Centralized compliance monitoring, configuration auditing, and automated remediation using AWS Config and AWS Security Hub.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic