Examkin

Soru

Zorluk: OrtaSecurity Monitoring and Threat Detection

A healthcare technology company hosts its patient record management system on AWS. The security team needs to monitor the environment to ensure that Network Access Control Lists (NACLs) and Security Groups do not accidentally allow unrestricted inbound traffic on port 22 from the public internet. The solution must continuously audit configuration history, evaluate compliance, and send near-real-time alerts when a non-compliant change is detected. Which architectural solution meets these requirements with the least administrative effort?

  1. Enable AWS Config to record configuration changes for security groups and Network ACLs, and use the managed compliance rule for restricted SSH. Configure Amazon EventBridge to detect non-compliant states and send alerts through Amazon Simple Notification Service (Amazon SNS).Cevap
  2. B
    Configure AWS Config rules to monitor Network ACLs under the assumption that the stateful nature of Network ACLs will automatically track and permit return traffic for approved SSH sessions, making security group rules redundant.
  3. C
    Deploy AWS Shield Advanced and configure AWS WAF to monitor inbound traffic on port 22 at the application layer, relying on Shield to automatically block unauthorized SSH configuration exploits and trace historical changes to security groups.
  4. D
    Develop a custom Python script hosted on an Amazon EC2 instance that continuously polls the security group configurations using credentials from an IAM user with root privileges, storing the access keys as a plaintext parameter in Systems Manager Parameter Store.

Cevap

Enable AWS Config to record configuration changes for security groups and Network ACLs, and use the managed compliance rule for restricted SSH. Configure Amazon EventBridge to detect non-compliant states and send alerts through Amazon Simple Notification Service (Amazon SNS).
The correct solution uses AWS Config to monitor and record configuration history for security groups and Network ACLs. AWS Config features a managed rule (restricted-ssh) specifically designed to evaluate whether security groups permit unrestricted public access to port 22. Combining AWS Config with Amazon EventBridge and Amazon SNS provides a serverless, managed pipeline to send near-real-time alerts whenever a resource becomes non-compliant, satisfying all requirements with minimal administrative overhead.

Adım Adım Çözüm

1
Enable AWS Config recording
AWS Config tracks and records all configuration changes for security groups and Network ACLs, establishing an audit history.
Auditing configuration history is a key requirement of the security team.
2
Deploy the AWS Config managed rule for restricted SSH
AWS Config continuously evaluates whether security groups or NACLs permit unrestricted inbound traffic on port 22 (SSH).
This automates the compliance evaluation without requiring custom script development.
3
Configure an EventBridge rule and Amazon SNS topic
Non-compliant evaluation states trigger an EventBridge event, which forwards a notification to an SNS topic for immediate alert dispatch.
This establishes near-real-time alerting with a fully serverless, low-maintenance design.

Anahtar Kavram

Continuous security monitoring, compliance auditing, and near-real-time alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Bu soruyu puanla

Konular

Security Monitoring and Threat Detection

Bu konudan daha fazla soru