Exam AWS DevOps Engineer Professional topic 1 question 179 discussion

Exam question from Amazon's AWS DevOps Engineer Professional

Question #: 179
Topic #: 1

[All AWS DevOps Engineer Professional Questions]

A company has a VPC that consists of a public subnet and a private subnet. The company has an application that runs on Amazon EC2 instances that are in the private subnet. An Application Load Balancer is in the public subnet and distributes traffic to the EC2 instances.

The company has enabled Amazon GuardDuty for the account. The company’s DevOps team has a list of external IP ranges that is updated each day. The list is stored in an Amazon S3 bucket in the account. A DevOps engineer needs to configure GuardDuty to create a GuardDuty finding when traffic to the application originates from an IP range in the external IP range list.

Which solution will meet these requirements?

A. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to retrieve the most recent list of external IP ranges from the S3 bucket. For each IP range in the list, configure the Lambda function to create a GuardDuty finding filter on the publicIp filter attribute.
B. Configure a threat list in GuardDuty. Set the source as the list of external IP ranges in the S3 bucket. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to refresh the threat list in GuardDuty to match the list of external IP ranges in the S3 bucket.
C. Configure a trusted IP list in GuardDuty. Set the source as the list of external IP ranges in the S3 bucket. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to refresh the trusted IP list in GuardDuty to match the list of external IP ranges in the S3 bucket.
D. Create an Amazon EventBridge rule that runs daily and invokes an AWS Lambda function. Configure the Lambda function to retrieve the most recent list of external IP ranges from the S3 bucket. For each IP range in the list, configure the Lambda function to create a GuardDuty finding filter on the localIp filter attribute.

Show Suggested Answer

Suggested Answer: B 🗳️

by saeidp at Feb. 24, 2023, 10:56 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

lunt

2 years ago

Selected Answer: B

Can only be B. C= does not generate a finding for trusted IPs. They might be logged but by default no finding.

upvoted 1 times

...

easytoo

2 years, 3 months ago

b-b-b-bb-b-b-b-b-b-b-b

upvoted 1 times

...

Mark1000

2 years, 5 months ago

It is definitely the B https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html

upvoted 3 times

SHoKMaSTeR

2 years, 5 months ago

Agree. From the link: "For Location, specify the location of the list - this is the S3 bucket where you store your trusted IP list or threat list and the file that contains your list"

upvoted 1 times

...

CloudFloater

2 years, 5 months ago

Selected Answer: B

B is the right answer because configuring a threat list will automatically create a finding not A because creates only filter not a finding not C because we want to block the list not trust it not D because creates only filter not finding

upvoted 3 times

...

saeidp

2 years, 5 months ago

Selected Answer: A

Correct answere is A https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_filter-findings.html

upvoted 1 times

...