Examkin

Soru

Zorluk: OrtaSecurity Monitoring and Threat Detection

A software-as-a-service (SaaS) company wants to detect potential threats within its AWS account, including compromised IAM credentials and EC2 instances communicating with command-and-control servers. When a threat is detected, the security team must be notified via a webhook to their external security operations center (SOC). The webhook URL requires an API key for authentication, which must be stored securely. Which architecture meets these requirements with the least operational overhead?

  1. A
    Configure stateless Network ACLs on all VPC subnets to identify and block traffic to known command-and-control servers. Configure the Network ACLs to trigger an AWS Lambda function that retrieves the webhook API key from AWS Secrets Manager and sends the alert.
  2. Enable Amazon GuardDuty to monitor for threats and compromised credentials. Create an Amazon EventBridge rule that triggers an AWS Lambda function when GuardDuty generates a finding. Store the webhook API key in AWS Secrets Manager, and configure the Lambda function to retrieve the secret and call the webhook.Cevap
  3. C
    Enable Amazon GuardDuty to monitor for threats. Create an Amazon EventBridge rule that triggers an AWS Lambda function when GuardDuty generates a finding. Store the webhook API key as a plaintext String parameter in AWS Systems Manager Parameter Store, and configure the Lambda function to retrieve the parameter and call the webhook.
  4. D
    Enable AWS Shield Advanced to monitor API activity and network traffic for command-and-control communications. Configure a custom AWS WAF rule to trigger an AWS Lambda function that retrieves the webhook API key from AWS Secrets Manager and sends the alert.

Cevap

Enable Amazon GuardDuty to monitor for threats and compromised credentials. Create an Amazon EventBridge rule that triggers an AWS Lambda function when GuardDuty generates a finding. Store the webhook API key in AWS Secrets Manager, and configure the Lambda function to retrieve the secret and call the webhook.
Amazon GuardDuty is the AWS native threat detection service that continuously monitors VPC Flow Logs, CloudTrail logs, and DNS queries for potential security issues, including compromised IAM credentials and external command-and-control servers. Setting up an EventBridge rule to trigger an AWS Lambda function allows for real-time alerting to the external security operations center (SOC). Webhook API keys are sensitive credentials and must be stored securely using AWS Secrets Manager to prevent exposure.

Adım Adım Çözüm

1
Enable GuardDuty threat detection
Amazon GuardDuty automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events to detect malicious activities and unauthorized access patterns (e.g., C2 server communication, compromised IAM keys).
This establishes threat detection capabilities with no agent setup or network overhead.
2
Configure event-driven alerting
An Amazon EventBridge rule matches GuardDuty finding events and routes them to an AWS Lambda function.
This automates the alert pipeline in real-time.
3
Securely retrieve credentials and notify the SOC
The Lambda function retrieves the API key from AWS Secrets Manager and sends the authenticated alert payload to the SOC webhook.
Storing the key in AWS Secrets Manager ensures sensitive credentials are encrypted and stored according to security best practices.

Anahtar Kavram

Amazon GuardDuty is the managed threat detection service that monitors account activity and network behavior in AWS, which can trigger EventBridge rules to automate remediation or notification tasks. Sensitive credentials like API keys must be securely stored in AWS Secrets Manager or Parameter Store (SecureString) rather than in plaintext.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru