SAP-C02 Question 70
Select 3Your organization has recently adopted AWS Security Hub to enhance its security posture. You are tasked with ensuring compliance with industry standards and identifying vulnerabilities within your AWS environment. Additionally, you want to monitor for unintended external sharing of resources in near real-time. Which combination of AWS services and features should you use to achieve these objectives?
- A
Enable AWS Security Hub and integrate it with AWS Config to monitor compliance with industry standards.
- B
Use AWS Identity and Access Management (IAM) Access Analyzer to detect unintended external sharing of resources.
- C
Enable Amazon Inspector to continuously scan EC2 instances and container images for vulnerabilities.
- D
Activate AWS CloudTrail to block unauthorized API calls in real-time.
- E
Use AWS Trusted Advisor to automatically remediate non-compliant resources.
Show answer and explanation
Correct answers: A, B, C
Explanation
To enhance security and compliance, a combination of AWS services is required. AWS Security Hub provides centralized compliance monitoring, while IAM Access Analyzer detects unintended external sharing of resources. Amazon Inspector identifies vulnerabilities in EC2 instances and container images. Together, these services address the organization's needs for compliance, vulnerability management, and resource sharing monitoring. AWS CloudTrail and Trusted Advisor, while valuable, do not directly address the specific requirements stated in the scenario.
- A. Correct.
Enabling AWS Security Hub and integrating it with AWS Config allows you to monitor compliance with industry standards, such as CIS benchmarks and PCI DSS, providing a centralized view of your security posture.
- B. Correct.
AWS Identity and Access Management (IAM) Access Analyzer is specifically designed to detect unintended external sharing of AWS resources, making it suitable for this requirement.
- C. Correct.
Amazon Inspector continuously scans EC2 instances and container images for vulnerabilities, ensuring identified security risks can be addressed promptly.
- D. Incorrect.
While AWS CloudTrail provides detailed logs of API activities, it does not block unauthorized API calls in real-time. It is primarily used for auditing and monitoring, not active threat prevention.
- E. Incorrect.
AWS Trusted Advisor provides recommendations to optimize costs, security, and performance but does not automatically remediate non-compliant resources.