Examkin

Soru

Zorluk: Çok zorSecurity Monitoring and Threat Detection

A financial technology firm hosts a payment processing application on Amazon ECS inside a private VPC subnet. Public traffic is received via an Application Load Balancer (ALB). The compliance team dictates that the architecture must satisfy three main security requirements: continuously monitor all network interfaces and DNS queries for potential data exfiltration or threat patterns; audit any configurations to security groups and automatically revert unauthorized changes within minutes; and aggregate security status globally across multiple AWS accounts. Which two actions should the solutions architect take to meet these security monitoring and compliance requirements?

  1. Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 resolver query logs across all accounts to detect network-level anomalies and threat patterns.Cevap
  2. Create an AWS Config rule to evaluate security group rule compliance and associate it with an AWS Systems Manager Automation runbook to automatically remediate unauthorized rules.Cevap
  3. C
    Deploy AWS Shield Advanced on the Application Load Balancer to inspect HTTP payloads for SQL injection and cross-site scripting attacks, and automatically update the security groups.
  4. D
    Configure stateless Network Access Control Lists (NACLs) to dynamically monitor security group states and drop all return packets from unauthorized external IPs.
  5. E
    Configure AWS WAF to monitor VPC Flow Logs in real time and automatically add deny rules to the public subnet Network ACLs when traffic anomalies are detected.

Cevap

Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 query logs, and create an AWS Config rule to evaluate security groups with an AWS Systems Manager Automation runbook for remediation.
The correct architecture uses Amazon GuardDuty to process VPC Flow Logs and Route 53 query logs across all accounts to detect anomalies, and AWS Config rules to monitor security group modifications with Systems Manager Automation runbooks to immediately revert non-compliant configurations.

Adım Adım Çözüm

1
Select the threat detection service that natively ingests VPC Flow Logs and Route 53 query logs.
Amazon GuardDuty is selected to meet the requirement for network anomaly and threat detection.
GuardDuty uses machine learning and threat intelligence to analyze flow logs and DNS query logs without introducing performance overhead.
2
Identify the auditing and automated remediation tool for security groups.
AWS Config is chosen to monitor security group rules, paired with AWS Systems Manager Automation for automated remediation.
This combination audits resource configurations and triggers runbooks to revoke unauthorized ingress rules automatically.
3
Evaluate and rule out AWS Shield Advanced for application payload filtering.
AWS Shield Advanced is disqualified because payload filtering for SQL injection requires AWS WAF.
Shield is a DDoS mitigation service, not an application payload inspection firewall.
4
Evaluate and rule out stateless Network ACL configurations and WAF log analysis.
Stateless Network ACLs and WAF monitoring of VPC Flow Logs are disqualified due to stateless/stateful limitations and service scope mismatches.
Network ACLs cannot dynamically track connection state, and WAF cannot analyze flow logs.

Anahtar Kavram

Continuous security monitoring, threat detection, and automated compliance auditing using Amazon GuardDuty, AWS Config, and Systems Manager.
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru