Examkin

Soru

Zorluk: ZorSecurity Monitoring and Threat Detection

A financial technology startup has multiple AWS accounts managed under an AWS Organizations organization. The startup needs to implement a centralized logging and threat detection strategy. The security team must be alerted within minutes of any unauthorized IAM privilege escalation attempts or modifications to critical network infrastructure across all accounts. Additionally, they must ensure that all API activity log files are protected against modification or deletion, even by administrative users. Which combination of steps should the solutions architect recommend to meet these security monitoring and threat detection requirements? (Select TWO.)

  1. Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.Cevap
  2. Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.Cevap
  3. C
    Deploy AWS Shield Advanced across all accounts to monitor AWS CloudTrail logs for threat patterns and automatically block unauthorized IAM API calls.
  4. D
    Configure stateful Network ACLs at the subnet level to block any administrative users from performing API actions that modify S3 buckets containing CloudTrail logs.
  5. E
    Deploy AWS WAF at the VPC level for all EC2 instances to monitor AWS CloudTrail API calls for privilege escalation and block traffic from administrative users.

Cevap

The correct options are: enabling an AWS CloudTrail organization trail with log file integrity validation delivered to a centralized S3 bucket, and designating a delegated administrator for Amazon GuardDuty to monitor the logs and route findings via Amazon EventBridge.
Centralizing CloudTrail logs in a dedicated security account under an Organization trail provides a tamper-resistant architecture. Enabling CloudTrail log file integrity validation allows the detection of unauthorized modifications. Amazon GuardDuty analyses CloudTrail logs across accounts to identify privilege escalation and other security threats, and EventBridge provides the routing mechanism for alerts.

Adım Adım Çözüm

1
Address log security and auditing requirements.
Create a centralized AWS CloudTrail trail across the entire organization that deposits logs into a secure Amazon S3 bucket within a designated security account. Enable log file integrity validation to detect unauthorized modifications.
This establishes a tamper-evident audit trail of all API activity across the organization, satisfying the requirement to protect logs from deletion or modification by administrative users.
2
Address real-time threat detection and alerting requirements.
Enable Amazon GuardDuty in all accounts by delegating administration to the security account, and set up an Amazon EventBridge rule to route GuardDuty findings to the security team.
GuardDuty natively analyzes CloudTrail logs to detect anomalous IAM activity and potential privilege escalation. EventBridge allows automated routing of these findings for rapid alerting.

Anahtar Kavram

Centralized security monitoring, log integrity, and multi-account threat detection in AWS Organizations using CloudTrail and GuardDuty.
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru