A Security Engineer discovers that developers have been adding rules to security groups that allow SSH and RDP traffic from 0.0.0.0/0 instead of the organization firewall IP. What is the most efficient way to remediate the risk of this activity?
A.
Delete the internet gateway associated with the VPC.
B.
Use network access control lists to block source IP addresses matching 0.0.0.0/0.
C.
Use a host-based firewall to prevent access from all but the organization's firewall IP.
D.
Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.
D will be more appropriate, if using NACL to block 0.0.0.0/0 it will affect those instances not associated with the security group as well, my ans will be D
agree, if use nacl it will block anything, what about the public reachable servers, they should have the choice as well. the question talk about the security groups level.
"What is the most efficient way to remediate the risk of this activity?"
This is an active solution. Blocking on NACL, what stops the developers that added the Rule to SG from removing the configured rule on NACL ?
D is correct because this is automated, continuous and active every time developers add the rule.
B is the correct answer. ACLs are on a subnet level, the majority of the time developers are resuing subnets when creating EC2 and SGs, so yeah blocking traffic from a range of IPs using ACLs makes sense. and it pretty easy
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
ugreenhost
Highly Voted 3 years, 9 months agolxgzmy
3 years, 9 months agonewbie2019
3 years, 9 months agoBillyC
Highly Voted 3 years, 9 months agoRaphaello
Most Recent 1 year, 4 months agoITGURU51
2 years, 1 month agomatrpro
2 years, 2 months agopatou
2 years, 2 months agovavofa5697
2 years, 2 months agoCedhulk
2 years, 4 months agoexam67
2 years, 6 months agoskillz2investor
2 years, 7 months agoarae
2 years, 8 months agoarae
2 years, 9 months agolotfi50
3 years agosanjaym
3 years, 8 months agoLarsson
3 years, 8 months agoChinkSantana
3 years, 8 months agoshooricg
3 years, 8 months agoexamtaker12
3 years, 8 months ago