Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is setting up automated security monitoring for an AWS environment. The administrator has enabled Amazon GuardDuty and wants to implement automated remediation for EC2 instances that are flagged with a finding type of 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom'. The remediation must isolate the affected EC2 instance by attaching a security group that denies all inbound and outbound traffic.

Which combination of actions must the administrator perform to meet these requirements? (Select TWO.)

  1. Create an Amazon EventBridge rule with an event pattern that filters for Amazon GuardDuty findings where the 'detail.type' matches 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom', and set the target to an AWS Systems Manager Automation document.Answer
  2. Ensure the Systems Manager Automation execution role has an IAM policy allowing the 'ec2:ModifyInstanceAttribute' action, and grant the administrator configuring the rule the 'iam:PassRole' permission for this execution role.Answer
  3. C
    Enable detailed monitoring on all EC2 instances in the VPC to ensure that GuardDuty processes network metrics at 11-minute intervals instead of the default 55-minute intervals.
  4. D
    Configure an AWS Config custom rule to continuously poll the GuardDuty findings list and invoke the remediation workflow when a new threat is detected.
  5. E
    Add a KMS key policy to the KMS key used by GuardDuty that allows the EC2 instances to decrypt the finding payloads before they are sent to EventBridge.

Answer

To implement this monitoring and automated remediation, the administrator must create an Amazon EventBridge rule that filters for the specific GuardDuty finding type and targets a Systems Manager Automation document, and ensure the execution role has the required EC2 modification permissions and is passed to the service with 'iam:PassRole' permissions.
Automating remediation of GuardDuty findings requires capturing the finding via Amazon EventBridge, which receives all GuardDuty findings natively. An EventBridge rule must be created with a pattern matching the finding type and targeted at a Systems Manager Automation document. To perform the isolation, the Systems Manager execution role requires the 'ec2:ModifyInstanceAttribute' action to change the instance's associated security groups. The administrator configuring this target must have 'iam:PassRole' permissions to grant EventBridge the ability to pass the execution role to Systems Manager.

Step-by-Step Solution

1
Set up EventBridge routing for the GuardDuty threat event.
An Amazon EventBridge rule is created to capture GuardDuty findings and filter specifically for the 'UnauthorizedAccess:EC2/MaliciousIPCaller.Custom' finding type.
Amazon GuardDuty automatically publishes finding events to EventBridge in near real-time, allowing event-driven workflows to trigger.
2
Configure the remediation target.
The EventBridge rule is configured to target an AWS Systems Manager Automation document that isolates the EC2 instance.
Systems Manager Automation provides pre-built and custom runbooks to perform operational tasks such as modifying EC2 configuration.
3
Configure the necessary IAM execution and PassRole permissions.
The Systems Manager execution role is granted 'ec2:ModifyInstanceAttribute' to change the instance security group, and the administrator is granted the 'iam:PassRole' permission.
The execution role needs API permissions to modify the instance, and the configuring administrator must have permission to pass this IAM execution role to the Systems Manager service.

Key Concept

Centralized threat detection and automated remediation using Amazon GuardDuty, Amazon EventBridge, and AWS Systems Manager Automation with appropriate IAM execution roles.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic