ANS-C01 Question 483
Select 3Your organization has deployed a large number of EC2 instances with associated security groups across multiple AWS accounts. To ensure compliance with your company's security policies, you are tasked with auditing the security groups to identify overly permissive rules (e.g., rules allowing traffic from 0.0.0.0/0). Additionally, you need to ensure that these rules are remediated automatically where possible. Which combination of AWS tools can help you achieve this task?
- A
AWS Trusted Advisor for identifying overly permissive security group rules
- B
AWS Firewall Manager for centralized management and automatic remediation of security group rules
- C
Amazon GuardDuty for auditing security group configurations across AWS accounts
- D
AWS Config for continuously monitoring security group configurations and triggering remediation actions
- E
Amazon Inspector for identifying and remediating overly permissive security group rules
Show answer and explanation
Correct answers: A, B, D
Explanation
To audit network security configurations such as overly permissive security group rules and remediate them automatically, a combination of AWS Trusted Advisor, AWS Firewall Manager, and AWS Config is ideal. AWS Trusted Advisor provides visibility into overly permissive rules, AWS Firewall Manager centralizes policy enforcement and remediation, and AWS Config continuously monitors and triggers remediation actions for non-compliant configurations. Amazon GuardDuty and Amazon Inspector serve different purposes and are not suitable for this specific task.
- A. Correct.
AWS Trusted Advisor provides a security check for overly permissive security group rules. It identifies issues such as rules allowing unrestricted access (e.g., 0.0.0.0/0) and provides recommendations.
- B. Correct.
AWS Firewall Manager allows you to enforce security policies across multiple accounts, including automatically auditing and remediating overly permissive security group rules.
- C. Incorrect.
Amazon GuardDuty is a threat detection service that monitors for malicious activity but does not audit or remediate security group configurations.
- D. Correct.
AWS Config allows for continuous monitoring of resource configurations, including security groups, and can trigger automated remediation actions based on non-compliance.
- E. Incorrect.
Amazon Inspector is used for assessing vulnerabilities and deviations in application security but does not handle auditing or remediating security group rules.