ANS-C01 Question 482
Select 2Your organization has been experiencing misconfigured security groups that inadvertently expose sensitive resources to the internet. As the lead network architect, you are tasked with implementing a solution to continuously audit and enforce secure network configurations. Which combination of AWS services should you use to achieve this goal?
- A
AWS Config to track security group changes and AWS Firewall Manager to enforce compliance policies.
- B
AWS Trusted Advisor to provide security group recommendations and AWS Config to track resource compliance.
- C
Amazon GuardDuty to monitor VPC traffic and AWS Config to automatically remediate misconfigured security groups.
- D
AWS Firewall Manager to enforce security group compliance at the organizational level and AWS Trusted Advisor to identify overly permissive security group rules.
Show answer and explanation
Correct answers: A, B
Explanation
To effectively audit and enforce secure network configurations, AWS Config is essential for tracking changes to security groups and ensuring compliance. AWS Firewall Manager can enforce security policies across your organization. AWS Trusted Advisor complements this by identifying overly permissive configurations. Together, these tools provide a comprehensive solution for auditing and securing your network configuration.
- A. Correct.
Correct. AWS Config can track changes to security groups and evaluate them against compliance rules, while AWS Firewall Manager enforces organization-wide policies for network security, including security groups.
- B. Correct.
Correct. AWS Trusted Advisor provides insights into overly permissive security groups, and AWS Config tracks compliance to ensure resources adhere to security requirements.
- C. Incorrect.
Incorrect. While Amazon GuardDuty is useful for monitoring suspicious activity and VPC traffic, it does not provide functionality to track or remediate misconfigured security groups.
- D. Incorrect.
Incorrect. AWS Firewall Manager can enforce security group compliance, but AWS Trusted Advisor alone does not provide automated enforcement or tracking capabilities.