SOA-C02 Question 221
Single answerYour organization uses AWS Security Hub to monitor and enhance the security posture of your AWS environment. You have received a finding from AWS Security Hub indicating an EC2 instance is flagged due to an open port that is not compliant with your organization's security standards. What is the most appropriate next step to address this finding?
- A
Investigate the finding, identify the security group associated with the EC2 instance, and update the security group rules to remove the open port if it is unnecessary.
- B
Terminate the flagged EC2 instance immediately to eliminate the risk associated with the open port.
- C
Ignore the finding if the EC2 instance is in a development environment, as it does not affect production.
- D
Disable AWS Security Hub to stop receiving similar findings for non-compliant ports.
Show answer and explanation
Correct answer: A
Explanation
When AWS Security Hub identifies a non-compliant resource, the recommended approach is to investigate the finding and take corrective actions to address the issue. In this scenario, the open port on the EC2 instance needs to be reviewed, and unnecessary ports should be closed by updating the associated security group rules. This ensures alignment with organizational security policies without unnecessarily terminating resources or ignoring the issue.
- A. Correct.
This is the correct approach. Reviewing the finding, understanding the impact of the open port, and updating the security group rules to align with security best practices is the most appropriate step. Removing unnecessary open ports reduces the potential attack surface.
- B. Incorrect.
Terminating the instance is not an appropriate first step. The flagged finding does not necessarily mean the instance needs to be terminated but rather that the security configuration should be reviewed and adjusted.
- C. Incorrect.
Ignoring the finding is not a best practice, even if the instance is in a development environment. Security compliance should be maintained across all environments to prevent potential vulnerabilities.
- D. Incorrect.
Disabling AWS Security Hub is not a solution to address the finding and would lead to a lack of visibility into security issues across your AWS environment.