A Security Engineer must design a system that can detect whether a file on an Amazon EC2 host has been modified. The system must then alert the Security Engineer of the modification. What is the MOST efficient way to meet these requirements?
A.
Install antivirus software and ensure that signatures are up-to-date. Configure Amazon CloudWatch alarms to send alerts for security events.
B.
Install host-based IDS software to check for file integrity. Export the logs to Amazon CloudWatch Logs for monitoring and alerting.
C.
Export system log files to Amazon S3. Parse the log files using an AWS Lambda function that will send alerts of any unauthorized system login attempts through Amazon SNS.
D.
Use Amazon CloudWatch Logs to detect file system changes. If a change is detected, automatically terminate and recreate the instance from the most recent AMI. Use Amazon SNS to send notification of the event.
Change my answer to B.
CloudWatch Log is not suitable to detect granular file system change.
It will require system tools such as IDS or use an OS audit package to do so:
https://aws.amazon.com/premiumsupport/knowledge-center/ec2-monitor-file-system-changes/
This is an old question, you can (and I'd say you should) track file changes with AWS Config:
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html
D is incorrect because CW logs can't detect file change (integrity). Only CloudTrail can do it
Also there is no need to recreate EC2 like that :D. There is not any question talking about how to recover the file, even recover a file, we don't need to recreate an instance.
Why is a stupid answer D ? Detect a file change to terminate and re-create the instance ? I don't think it is a good solution for change management, the best way is B.
D- The most efficient way is to make use of AWS services - CloudWatch Log, configure metric and send notification by SNS. with SNS you can receive email alert without having to login to AWS to check CloudWatch Alarms.
Third party HIDS requires setup EC2 and maintenance of instances, OS and s/w patches.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Daniel76
Highly Voted 3 years, 8 months agokiev
Highly Voted 3 years, 8 months agoRaphaello
Most Recent 1 year, 4 months agomamila
1 year, 10 months agovavofa5697
2 years, 2 months agoITGURU51
2 years, 3 months agoskillz2investor
2 years, 7 months agoplpatankar
2 years, 10 months agoRoot_Access
2 years, 10 months agoMillarD
3 years, 5 months agoChauPhan
3 years, 8 months agoKdosec
3 years, 8 months agosanjaym
3 years, 8 months agoEA_Practice
3 years, 8 months agoeskimolander
3 years, 8 months agoDaniel76
3 years, 8 months agoHuy
3 years, 9 months agoChinkSantana
3 years, 9 months agoEdgecrusher77
3 years, 9 months ago