Examkin

Soru

Zorluk: ZorSecurity Monitoring and Threat Detection

A financial services company hosts its customer-facing portal on AWS using a multi-tier architecture. The portal is fronted by an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in private subnets. The security team needs to implement a solution to centrally monitor and aggregate security findings across all AWS accounts in the organization, continuously evaluate AWS resource configurations against security best practices (specifically checking for public S3 buckets and overly permissive security groups), and protect the web application from SQL injection attacks and HTTP flood attacks at the application layer. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. A
    Deploy AWS Shield Standard on the Application Load Balancer to inspect incoming HTTP request bodies for SQL injection patterns and block request floods. Enable AWS Systems Manager to record security group changes, and configure AWS Config to aggregate findings across the organization.
  2. Enable AWS Security Hub across all accounts in the AWS Organization to aggregate findings in a central security administrator account. Enable AWS Config in all accounts to continuously audit security group and Amazon S3 bucket configurations. Deploy AWS WAF on the Application Load Balancer with managed rules to block SQL injection and HTTP flood attacks.Cevap
  3. C
    Enable AWS Security Hub to aggregate findings across all accounts. Configure Network ACLs to statefully filter port 22 and port 3389 traffic at the subnet level, and configure AWS Config to track Security Groups applied to subnets. Deploy AWS WAF on the Application Load Balancer.
  4. D
    Deploy AWS Shield Standard on the Application Load Balancer to mitigate application-layer threat patterns. Configure stateless Security Groups at the subnet level to inspect and block unauthorized administrative traffic, and use AWS Config to record compliance findings.

Cevap

The configuration that enables AWS Security Hub for centralized aggregation, AWS Config for configuration compliance auditing, and AWS WAF on the Application Load Balancer for application-layer protection.
The correct architecture uses AWS Security Hub to consolidate security findings across all AWS accounts in the organization, enabling a unified view of the security posture. AWS Config continuously records resource configuration changes and evaluates them against rules (such as checking for public S3 buckets and restricted ports in security groups). To protect the portal against SQL injection and HTTP flood attacks, AWS WAF is deployed on the Application Load Balancer to inspect incoming HTTP/HTTPS traffic at Layer 7.

Adım Adım Çözüm

1
Analyze requirements for application-layer threat protection, continuous resource configuration monitoring, and centralized security aggregation.
Identify that SQL injection and HTTP flood attacks require Layer 7 traffic inspection, configuration auditing requires continuous compliance checking, and centralization requires multi-account findings aggregation.
This establishes the functional boundary for selecting the correct AWS services.
2
Evaluate candidate services for Layer 7 web security.
Determine that AWS WAF is the correct service to block SQL injection and HTTP floods via managed rules, whereas AWS Shield Standard only handles Layer 3 and 4 DDoS protection.
This filters out distractors using Shield Standard for application-layer inspection.
3
Evaluate options for configuration auditing and multi-account compliance monitoring.
Determine that AWS Config audits resource configurations continuously, and AWS Security Hub integrates with AWS Organizations to aggregate these findings into a central administrator account.
This completes the required SAA architecture by leveraging AWS native integration features.

Anahtar Kavram

Centralized security monitoring and application-layer threat detection utilizing AWS Security Hub, AWS Config, and AWS WAF.
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru