Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

An online gaming corporation hosts its multiplayer game servers on Amazon EC2 instances within public and private subnets. The security team wants to monitor network traffic for anomalous behaviors, such as unauthorized port scanning and communication with known malicious IP addresses. Additionally, they must ensure that any modifications to subnet-level network boundaries are recorded and audited for compliance. Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. A
    Apply stateful Security Groups at the subnet level to block incoming malicious traffic and track connection states.
  2. Enable Amazon GuardDuty to analyze VPC Flow Logs and detect network-layer threat patterns and traffic anomalies.Answer
  3. C
    Enable AWS Shield Standard to inspect Layer 7 traffic on the subnets and automatically mitigate application-specific exploits.
  4. Use AWS Config to record configuration changes for Network Access Control Lists (NACLs) and evaluate them for compliance.Answer
  5. E
    Configure Network Access Control Lists (NACLs) to statefully track outbound sessions and dynamically block traffic from known threat lists.

Answer

The correct options are enabling Amazon GuardDuty to analyze VPC Flow Logs for network-layer threat detection, and using AWS Config to record and evaluate Network Access Control List configuration changes for compliance.
Threat detection is achieved by enabling Amazon GuardDuty, which ingests VPC Flow Logs to analyze and alert on malicious network activity such as port scanning or communication with command-and-control servers. Auditing subnet boundaries requires AWS Config, which monitors configuration changes for Network ACLs to ensure compliance over time.

Step-by-Step Solution

1
Address the requirement to monitor network traffic for anomalous behaviors and malicious communication.
Enable Amazon GuardDuty, which automatically analyzes VPC Flow Logs to detect threats such as port scanning or known malicious IP communication.
VPC Flow Logs capture network traffic metadata, and GuardDuty applies threat intelligence and machine learning to identify security threats.
2
Address the requirement to audit subnet-level network boundary changes.
Use AWS Config to monitor and record modifications to Network Access Control Lists (NACLs), which act as subnet-level firewalls.
AWS Config tracks configuration changes and histories of resources like NACLs, allowing compliance auditing.

Key Concept

Using Amazon GuardDuty for intelligent threat detection via VPC Flow Logs and AWS Config for auditing resource compliance of Network ACLs.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic