ANS-C01 Question 484
Select 3Your organization operates in a multi-account setup with hundreds of security groups across different AWS accounts. To ensure compliance with security policies, you are tasked with auditing security group configurations for overly permissive rules, such as wide-open ports or unrestricted IP ranges. Which combination of tools and services can you use to automate this audit process and ensure compliance?
- A
AWS Trusted Advisor
- B
AWS Firewall Manager
- C
Amazon Inspector
- D
AWS Config
- E
AWS Network Firewall
Show answer and explanation
Correct answers: A, B, D
Explanation
To audit security group configurations effectively in a multi-account setup, you can use AWS Trusted Advisor to identify overly permissive rules, AWS Firewall Manager to enforce and audit compliance across accounts, and AWS Config to monitor and evaluate security group changes against compliance rules. Together, these tools provide a comprehensive solution for auditing and maintaining secure network configurations.
- A. Correct.
AWS Trusted Advisor provides recommendations for improving security by identifying overly permissive security group rules, such as those allowing 0.0.0.0/0. It is a useful tool for auditing security group configurations.
- B. Correct.
AWS Firewall Manager is designed for managing and auditing firewall rules across multiple accounts. It can help ensure compliance with security policies, including monitoring security groups for specific configurations.
- C. Incorrect.
Amazon Inspector is primarily used for vulnerability assessments and doesn't provide direct functionality for auditing security group configurations.
- D. Correct.
AWS Config allows you to track configuration changes to security groups and evaluate them against compliance rules. It can be used to detect and audit overly permissive rules.
- E. Incorrect.
AWS Network Firewall provides network-level protection but is not intended for auditing security group configurations.