SCS-C02 Question 397
Select 2An organization has recently migrated its web application to an Amazon EC2 instance. To enhance security, they want to ensure that the instance's SSH access is restricted to specific corporate IP ranges and that any unauthorized attempts are logged. As a security engineer, what steps should you take to meet these requirements?
- A
Create a security group for the EC2 instance that allows inbound SSH traffic only from the corporate IP ranges.
- B
Enable VPC Flow Logs for the VPC to monitor and log all traffic, including unauthorized access attempts.
- C
Set up an IAM policy to explicitly deny SSH access to the EC2 instance for all users not in the corporate group.
- D
Use AWS WAF to block SSH access from unauthorized IP ranges.
- E
Configure AWS CloudTrail to log API calls for actions performed on the EC2 instance.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict SSH access to specific IP ranges, security groups should be configured accordingly. VPC Flow Logs can complement this by providing visibility into all traffic, including unauthorized attempts, allowing for compliance and forensic analysis. IAM policies, AWS WAF, and CloudTrail do not directly address the requirements of network-level SSH access control or logging of unauthorized attempts.
- A. Correct.
Correct: Security groups are the primary mechanism in AWS for controlling inbound and outbound traffic to EC2 instances. By specifying the corporate IP ranges, you can restrict SSH access appropriately.
- B. Correct.
Correct: VPC Flow Logs capture details about IP traffic within the VPC, including unauthorized access attempts. This aligns with the requirement to log such attempts.
- C. Incorrect.
Incorrect: IAM policies control access to AWS resources via the AWS Management Console or API, not network-level access to an EC2 instance. SSH access is managed by security groups or NACLs, not IAM policies.
- D. Incorrect.
Incorrect: AWS WAF is designed to protect web applications from common web exploits (e.g., SQL injection, cross-site scripting). It cannot directly block SSH traffic, which is not web-based.
- E. Incorrect.
Incorrect: While AWS CloudTrail logs API calls related to AWS resources, it does not provide details on network traffic or unauthorized SSH attempts.