Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A gaming company runs an application on Amazon EC2 instances in a private subnet. The security team needs to implement a solution to monitor network traffic for threats, specifically detecting if any EC2 instance has been compromised and is communicating with external command-and-control (C&C) servers. Additionally, they must monitor the configuration of their security groups to detect and alert on unauthorized changes. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. A
    Configure stateless Network ACLs to inspect outbound packets for malicious signatures and automatically block command-and-control servers, and use stateful Security Groups at the subnet level to monitor configuration changes.
  2. Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.Answer
  3. C
    Deploy AWS Shield Standard on the EC2 instances to monitor network payloads for command-and-control traffic, and use AWS WAF to monitor configuration changes to the security groups.
  4. D
    Configure AWS WAF on the private EC2 instances to analyze network flow logs for command-and-control threats, and use AWS Shield Standard to monitor security group configuration drift.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.
The correct answer combines Amazon GuardDuty and AWS Config. Amazon GuardDuty uses machine learning and threat intelligence to analyze VPC Flow Logs and detect compromised EC2 instances talking to malicious command-and-control servers. AWS Config records configurations of AWS resources and detects when rules change, satisfying the compliance tracking requirement with minimum operational overhead.

Step-by-Step Solution

1
Select a managed service for threat detection in network traffic.
Amazon GuardDuty is selected.
GuardDuty automatically analyzes metadata sources such as VPC Flow Logs, DNS query logs, and CloudTrail management events to identify compromised instances communicating with malicious command-and-control endpoints.
2
Select a service for tracking AWS resource configuration and compliance.
AWS Config is selected.
AWS Config continuously monitors and records configuration details of AWS resources, allowing the creation of compliance rules to detect unauthorized changes in security groups.
3
Evaluate the operational overhead and capability limits of alternative services.
Incorrect options are eliminated.
Stateless Network ACLs and stateful Security Groups cannot be used to audit configuration changes or perform deep packet threat inspection. AWS WAF and AWS Shield Standard operate at the web and edge layers for DDoS/Web exploits and cannot be used for internal configuration auditing or VPC-level threat monitoring.

Key Concept

Continuous security monitoring and threat detection in AWS requires combining GuardDuty for behavior-based threat analysis and AWS Config for resource configuration tracking.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic