Examkin

Soru

Zorluk: OrtaSecurity Monitoring and Threat Detection

A financial company stores sensitive customer data in Amazon S3 buckets. The company's security team needs to implement a solution to monitor the AWS environment. The solution must detect anomalous data access patterns and potential data exfiltration attempts on the S3 buckets in near-real-time. Additionally, the solution must continuously audit and record configuration changes to the S3 buckets to evaluate compliance against security baselines. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Amazon GuardDuty with S3 Protection enabled to analyze S3 data events and identify anomalous access patterns.Cevap
  2. AWS Config to track configuration history and continuously evaluate bucket settings against security rules.Cevap
  3. C
    AWS Shield Advanced to monitor application-layer data exfiltration patterns and block common web exploits.
  4. D
    Stateful security groups configured at the subnet level to restrict outbound S3 data traffic and log return traffic.
  5. E
    IAM users with long-term access keys configured for external auditing systems to manually verify compliance changes.

Cevap

The correct architecture uses Amazon GuardDuty with S3 Protection enabled to monitor data access patterns and detect potential exfiltration, along with AWS Config to record S3 configuration history and continuously audit compliance against baseline rules.
Amazon GuardDuty with S3 Protection is the native AWS threat detection service that monitors S3 data events (e.g. access patterns) using anomaly detection to identify data exfiltration. AWS Config tracks resource configuration changes (like S3 bucket policies) and automatically assesses them against rules for compliance auditing.

Adım Adım Çözüm

1
Identify the service for threat detection on S3 data plane activity.
Amazon GuardDuty with S3 Protection is selected.
GuardDuty monitors S3 API data events using machine learning to detect anomalies and threat signatures, satisfying the exfiltration detection requirement.
2
Identify the service for configuration history and compliance evaluation.
AWS Config is selected.
AWS Config records resource configurations and assesses them against rules to ensure compliance, satisfying the auditing requirement.
3
Evaluate and eliminate incorrect distractors based on security architecture principles.
Discard options proposing AWS Shield Advanced, subnet-level security groups, and long-term IAM user credentials.
These services either address different problems (DDoS mitigation), do not apply to S3/subnets directly, or violate the principle of least privilege.

Anahtar Kavram

Continuous compliance auditing combined with near-real-time threat detection on object storage allows architects to satisfy both monitoring and threat detection goals for sensitive data stores.
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru