A media streaming company hosts its transcoding fleet on Amazon EC2 instances inside a private subnet. The security team needs to ensure that all network interfaces adhere strictly to corporate security standards. Specifically, they must detect any modifications that open restricted ports to unauthorized CIDR blocks, automatically flag these instances as non-compliant, and immediately notify the security operations center. Which combination of AWS services should the solutions architect recommend to implement this security monitoring system? (Select TWO.)
- Enable AWS Config and configure the restricted-common-ports managed rule to evaluate whether security groups are blocking restricted port traffic.Answer
- Create an Amazon EventBridge rule that detects AWS Config compliance status changes and triggers an Amazon Simple Notification Service (Amazon SNS) topic to alert the security operations center.Answer
- CDeploy AWS Shield Advanced to inspect incoming packets at the subnet level and automatically revert modifications made to the security groups.
- DConfigure stateless Network ACLs on the private subnet to track change actions and automatically block administrative traffic at the instance level.
- EUse AWS account root user credentials to schedule a daily script that queries security group settings and sends emails directly via SMTP.
Answer
Enable AWS Config with the restricted-common-ports rule to monitor compliance, and create an Amazon EventBridge rule targeting an Amazon SNS topic to notify the security team when compliance status changes.
The correct solution uses AWS Config to monitor and record changes to security groups and evaluate them against compliance rules (such as restricted-common-ports). Amazon EventBridge receives state change events from AWS Config and triggers Amazon SNS to send immediate alerts to the security team.
Step-by-Step Solution
Key Concept
Continuous security compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.