SCS-C02 Question 252
Select 2An organization has deployed a critical application on Amazon EC2 instances running Amazon Linux. The security team has been tasked with ensuring host-based security by hardening the EC2 instances against potential attacks. Which of the following actions should the team take to meet this requirement? (Select TWO.)
- A
Disable unused ports and protocols on the EC2 instances.
- B
Use AWS Systems Manager to enforce automatic patching of the EC2 instances.
- C
Configure an Amazon S3 bucket policy to restrict access to the application's log files.
- D
Enable security groups to allow unrestricted inbound traffic for all ports.
- E
Install and configure intrusion detection software on the EC2 instances.
Show answer and explanation
Correct answers: A, E
Explanation
Host-based security focuses on measures to secure the individual instances, such as hardening the host and ensuring it is protected against attacks. Disabling unused ports and protocols reduces the attack surface, and intrusion detection software provides monitoring capabilities to identify potential threats. These actions are directly tied to securing the EC2 instances and are considered best practices in host-based security.
- A. Correct.
Disabling unused ports and protocols reduces the attack surface of the EC2 instances, making them less vulnerable to exploitation. This is a key part of host hardening and security.
- B. Incorrect.
Using AWS Systems Manager for automatic patching ensures that the EC2 instances remain up-to-date with the latest security updates, but this action is related to patch management rather than directly hardening the host.
- C. Incorrect.
Configuring an Amazon S3 bucket policy to restrict access to log files is a good practice for securing data, but it is not directly related to host-based security or hardening the EC2 instances.
- D. Incorrect.
Allowing unrestricted inbound traffic for all ports increases the attack surface, which is the opposite of hardening the host and is not a recommended security practice.
- E. Correct.
Installing and configuring intrusion detection software on the EC2 instances provides a mechanism to detect and respond to security threats, which is an essential part of host-based security.