Topic 1 Question 339
A security team must record the configuration of AWS resources, detect issues, and send notifications for findings. The main workload in the AWS account consists of an Amazon EC2 Auto Scaling group that scales in and out several times during the day.
The team wants to be notified within 2 days if any Amazon EC2 security group allows traffic on port 22 for 0.0.0.0/0. The team also needs a snapshot of the configuration of the AWS resources to be taken routinely.
The security team has already created and subscribed to an Amazon Simple Notification Service (Amazon SNS) topic.
Which solution meets these requirements?
Configure AWS Config to use periodic recording for the AWS account. Deploy the vpc-sg-port-restriction-check AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
Configure AWS Config to use configuration change recording for the AWS account. Deploy the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
Configure AWS Config to use configuration change recording for the AWS account. Deploy the ssh-restricted AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
Create an AWS Lambda function to evaluate security groups and publish a message to the SNS topic. Use an Amazon EventBridge rule to schedule the Lambda function to run once a day.
ユーザの投票
コメント(7)
- 正解だと思う選択肢: C
Configuration Change Recording: By configuring AWS Config to use configuration change recording, the system will continuously monitor and record configurations of your AWS resources whenever there are changes. This ensures real-time compliance monitoring and reduces the delay in detection.
Appropriate Managed Rule: The ssh-restricted AWS Config managed rule specifically checks for security groups that allow unrestricted SSH (port 22) access. This rule directly addresses the requirement to be notified if any EC2 security group allows traffic on port 22 for 0.0.0.0/0.
Notification Setup: Configuring AWS Config to use the SNS topic ensures that the security team will be notified within the specified time frame if the rule is violated. AWS Config can send notifications to the SNS topic as soon as a non-compliant resource is detected.
👍 4f4b18ba2024/11/22 - 正解だと思う選択肢: C
For monitoring if any EC2 security group allows traffic on port 22 (SSH) from 0.0.0.0/0: Use the managed AWS Config rule:
restricted-ssh This rule checks that security groups do not allow unrestricted incoming SSH traffic (port 22) from 0.0.0.0/0.
👍 4spring212024/12/21 - 正解だと思う選択肢: C
The correct answer is C
👍 3uncledana2024/11/19
シャッフルモード