SCS-C02 Question 85
Select 3Your organization has recently deployed a set of Amazon EC2 instances running critical applications. To meet compliance requirements, the security team must be notified immediately if any unauthorized changes are made to the security groups attached to these instances. Which combination of actions will allow you to design and implement a monitoring and alerting solution to meet this requirement?
- A
Enable AWS CloudTrail and configure a trail to log management events in an S3 bucket.
- B
Create an Amazon CloudWatch alarm based on AWS Config rules that evaluate changes to security groups.
- C
Configure an Amazon SNS topic and subscribe the security team’s email to receive notifications.
- D
Use Amazon GuardDuty to monitor network activity and detect changes to security groups.
- E
Set up an AWS Config rule to track changes to security groups and integrate it with Amazon SNS.
Show answer and explanation
Correct answers: A, C, E
Explanation
To monitor and alert on unauthorized changes to security groups, you should use AWS CloudTrail to log API calls and record changes, AWS Config to evaluate configuration changes, and Amazon SNS to notify the security team. GuardDuty is not applicable here as it focuses on anomaly detection and threat intelligence, not configuration monitoring. CloudWatch alarms are unnecessary since AWS Config directly integrates with SNS for notifications.
- A. Correct.
Correct. AWS CloudTrail logs API activity, including changes to security groups, which is essential for tracking unauthorized changes.
- B. Incorrect.
Partially correct. While AWS Config rules can evaluate changes, creating a CloudWatch alarm is not directly required in this scenario. Config rules can directly notify via SNS.
- C. Correct.
Correct. Amazon SNS can be used to send notifications to the security team when triggered by an AWS Config rule.
- D. Incorrect.
Incorrect. While GuardDuty is a powerful threat detection tool, it does not monitor changes to security group configurations directly.
- E. Correct.
Correct. AWS Config rules are designed to track configuration changes, including those to security groups, and can be integrated with SNS for notifications.