SCS-C02 Question 253
Select 2Your organization has deployed an Amazon EC2 instance running a critical application. To comply with security and compliance policies, you need to ensure the instance is hardened and protected against unauthorized access while allowing only necessary traffic. Which of the following actions should you take to achieve this? (Select TWO)
- A
Enable a host-based firewall on the EC2 instance and configure rules to allow only necessary ports.
- B
Install an antivirus solution on the EC2 instance to protect against malware.
- C
Disable the Security Group associated with the EC2 instance to prevent external access.
- D
Use the EC2 instance metadata service to block all incoming traffic.
- E
Disable unused services and protocols on the EC2 instance.
Show answer and explanation
Correct answers: A, E
Explanation
To harden and secure the EC2 instance, enabling a host-based firewall to control traffic and disabling unused services are essential actions. Host-based firewalls provide fine-grained control over traffic at the instance level, while disabling unnecessary services minimizes the attack surface. These measures align with best practices for host-based security while ensuring compliance with security policies.
- A. Correct.
Correct. Enabling a host-based firewall and configuring rules for only necessary ports ensures that the EC2 instance is protected at the host level from unauthorized network access.
- B. Incorrect.
While installing antivirus software is a good practice for protecting against malware, it does not address the broader requirement of hardening and managing access to the instance.
- C. Incorrect.
Disabling the Security Group would block all external access, including legitimate traffic, which is not a feasible solution for maintaining application functionality.
- D. Incorrect.
The EC2 instance metadata service is not used to block incoming traffic. Its primary purpose is to provide instance-specific metadata and is unrelated to traffic control.
- E. Correct.
Correct. Disabling unused services and protocols reduces the attack surface of the instance, which is a key step in hardening.