Topic 1 Question 254

AWS Certified Security - Specialty

Topic 1 Question 254
A company has a strict policy against using root credentials. The company’s security team wants to be alerted as soon as possible when root credentials are used to sign in to the AWS Management Console.

How should the security team achieve this goal?
- Use AWS Lambda to periodically query AWS CloudTrail for console login events and send alerts using Amazon Simple Notification Service (Amazon SNS).
- Use Amazon EventBridge to monitor console logins and direct them to Amazon Simple Notification Service (Amazon SNS).
- Use Amazon Athena to query AWS IAM Identity Center logs and send alerts using Amazon Simple Notification Service (Amazon SNS) for root login events.
- Configure AWS Resource Access Manager to review the access logs and send alerts using Amazon Simple Notification Service (Amazon SNS).
ユーザの投票
コメント(3)
- 正解だと思う選択肢: B
  it tests you if you know that cloudtrail is enabled by default, which can be consumed by eventbridge and sns for quick alerts
  
  👍 1
  723993f2024/11/25
- 正解だと思う選択肢: B
  The most effective way to achieve this goal is to use Amazon EventBridge.
  
  EventBridge Rule: Create an EventBridge rule that triggers on console login events. Target SNS Topic: Configure the rule to send notifications to an SNS topic. SNS Subscriptions: Subscribe relevant security team members or security tools to the SNS topic. This approach offers several advantages:
  
  Real-time Monitoring: EventBridge can detect and respond to events in real-time, ensuring immediate alerts for root logins. Scalability: EventBridge can handle a large volume of events efficiently, making it suitable for large-scale environments. Flexibility: EventBridge can be integrated with various AWS services, allowing for customization and automation of response actions. Cost-Effective: EventBridge is a serverless service, so you only pay for the resources consumed.
  
  👍 1
  IPLogic2024/12/05
- 正解だと思う選択肢: B
  EventBridge, create a rule with the following event pattern: json Copy code { "detail": { "eventName": ["ConsoleLogin"], "userIdentity": { "type": ["Root"] }, "responseElements": { "ConsoleLogin": ["Success"] } } } This ensures that only root user login events trigger the rule
  
  👍 1
  TareDHakim2025/01/05
シャッフルモード

ユーザの投票

コメント(3)