SCS-C02 Question 93
Select 3A large e-commerce company uses multiple AWS services to host its application. The security team wants to ensure they are immediately notified if there are unauthorized API calls or changes to critical IAM roles. Additionally, they want to automate responses to such events, such as disabling the compromised IAM user. Which combination of AWS services can best achieve this?
- A
Amazon CloudWatch with CloudWatch Alarms
- B
AWS EventBridge (Amazon CloudWatch Events)
- C
AWS Config
- D
Amazon GuardDuty
- E
AWS Lambda
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements of detecting unauthorized API calls and automating responses, a combination of CloudWatch with Alarms, EventBridge, and Lambda is necessary. CloudWatch detects anomalies and triggers alarms, EventBridge routes the specific events to targets like Lambda, and Lambda executes the automated remediation actions. While AWS Config and GuardDuty are useful for monitoring and threat detection, they do not fulfill the automation and alerting requirements in this scenario.
- A. Correct.
Amazon CloudWatch with CloudWatch Alarms can monitor metrics and trigger alarms for anomalies, such as unauthorized API calls. It is a critical component for real-time monitoring and alerting.
- B. Correct.
AWS EventBridge (formerly CloudWatch Events) is used to detect specific events such as unauthorized API actions and route them to targets like Lambda for automated responses.
- C. Incorrect.
AWS Config tracks configuration changes in your AWS environment but does not provide real-time event monitoring or automated response capabilities.
- D. Incorrect.
Amazon GuardDuty is a threat detection service that identifies malicious or unauthorized behaviors, but it doesn't provide direct automation for responses.
- E. Correct.
AWS Lambda is a serverless service that can be triggered by EventBridge to execute automated responses, such as disabling a compromised IAM user.