Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

A financial services company hosts a multi-tier application in a VPC and must comply with a strict security policy requiring all subnet-level Network Access Control Lists (NACLs) to block unrestricted inbound SSH (port 22) and RDP (port 3389) traffic. The security team needs a solution that continuously monitors the NACL configurations, automatically alerts on any non-compliant changes, and reverts the non-compliant configurations to their secure state in near-real-time. Which solution meets these requirements with the least operational overhead?

  1. A
    Deploy AWS WAF at the subnet boundary and subscribe to AWS Shield Advanced. Configure a Web ACL rule to inspect incoming packets on ports 22 and 3389, and automatically block traffic from unauthorized IP ranges.
  2. Configure AWS Config to monitor Network ACL configurations using the nacl-no-unrestricted-ssh-rdp managed rule. Set up an AWS Systems Manager Automation document as the remediation action to revert any non-compliant NACL rules when a change is detected.Answer
  3. C
    Enable VPC Flow Logs to capture traffic. Use Amazon CloudWatch Logs to trigger an AWS Lambda function that dynamically creates stateful Security Group rules and applies them to the subnets to drop return traffic from unauthorized external addresses.
  4. D
    Configure AWS CloudTrail to monitor API activity. Create an Amazon EventBridge rule that filters for AuthorizeSecurityGroupIngress API calls, and configure it to trigger an AWS Lambda function to delete any rules that allow unrestricted SSH or RDP access.

Answer

Configure AWS Config to monitor Network ACL configurations using the nacl-no-unrestricted-ssh-rdp managed rule. Set up an AWS Systems Manager Automation document as the remediation action to revert any non-compliant NACL rules when a change is detected.
AWS Config is designed for configuration monitoring and compliance tracking. The managed rule 'nacl-no-unrestricted-ssh-rdp' automatically checks if any Network ACLs allow unrestricted inbound SSH or RDP traffic. When a non-compliant resource is detected, AWS Config can trigger a remediation action using AWS Systems Manager Automation to automatically modify the NACL and revert it to a secure state, providing a native, low-overhead solution.

Step-by-Step Solution

1
Enable AWS Config in the target region and record the AWS::EC2::NetworkAcl resource type.
AWS Config tracks the configuration states and changes of all Network ACLs in the VPC.
This establishes the monitoring foundation needed to detect configuration changes.
2
Deploy the nacl-no-unrestricted-ssh-rdp AWS Config managed rule.
The rule automatically evaluates all Network ACL configurations for compliance against the policy prohibiting unrestricted SSH/RDP access.
This provides automated compliance detection without requiring custom detection logic or script development.
3
Configure an AWS Systems Manager Automation document as a remediation action for the managed rule.
When a non-compliant NACL configuration is detected, the Systems Manager Automation document executes in near-real-time to modify the NACL back to its compliant state.
This accomplishes automated remediation and recovery of the resources with minimal operational overhead.

Key Concept

Automated configuration monitoring and remediation using AWS Config and Systems Manager Automation
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic