Exam AWS Certified Security - Specialty topic 1 question 282 discussion

Answer: B Both A and B would work but B in simpler and the question asks for a solution with MOST operational efficiency (nb simple)

Cannot be anything but B.

It can't be anything but B!

Both B and C solutions work. but i prefer B over C because it's less complex and less operational overhead

https://aws.amazon.com/blogs/security/how-to-monitor-and-visualize-failed-ssh-access-attempts-to-amazon-ec2-linux-instances/ Should be C, since it is real time monitoring.

Ans: B A:AWS Config: delivered in 6-hour intervals, as configuration history files. details about the resources that changed in that 6-hour, B: Inspector: Automated discovery and continual scanning that delivers near real-time vulnerability findings

For the managed rule, aws config service does not provide any delay.... AWS Config can be used to provide real time solution... Why B could not be the correct option becuase in the option B it is written "Use the AWS Config remediation feature to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic". AWS config remediation feature is basically used to remediate the change and it is not for publishing a message to AWS SNS topics. Should I expect a delay in reporting evaluation results for a managed rule with configuration changes? Any managed ruled affected by this change will be updated. You should not experience any delay in reporting evaluation results for a managed rule with configuration changes. https://docs.aws.amazon.com/config/latest/developerguide/faq.html#faq-4

Answer: B Not only can AWS Config monitor and detect deviations from desired configurations, but it can also be used together with other services, such as AWS Systems Manager, to automatically remediate such deviations when they are detected. These remediation actions are declared in Systems Manager automation documents, which are invoked by AWS Config when a resource is found to be noncompliant. This turns AWS Config into not only a detection mechanism, but also a near-real-time automated response one. https://aws.amazon.com/tw/blogs/mt/implement-aws-config-rule-remediation-with-systems-manager-change-manager/

near-real-time - cloudwatch reference: https://aws.amazon.com/blogs/security/how-to-automatically-revert-and-receive-notifications-about-changes-to-your-amazon-vpc-security-groups/

Answer C Config is not real time ( within 24 hours). Inspector - we need to schedule (again, not real time). Only option C is real time

I go on B, much simpler and it will work.

two methods one is near-real-time https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/ and Network Reachability package makes apply to SG https://docs.aws.amazon.com/inspector/v1/userguide/inspector_network-reachability.html Ans: A

restricted-ssh PDF RSS Checks if the incoming SSH traffic for the security groups is accessible. The rule is COMPLIANT when IP addresses of the incoming SSH traffic in the security groups are restricted (CIDR other than 0.0.0.0/0). This rule applies only to IPv4. Identifier: INCOMING_SSH_DISABLED Trigger type: Configuration changes

“design a system for near-real-time monitoring and alerting” A: https://aws.amazon.com/inspector/faqs/ “ Automated discovery and continual scanning that delivers near real-time vulnerability findings. “ Why NOT B: https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/ “ Changes to the security group’s configuration are reported during the next Config compliance evaluation, typically within 10 minutes. “

One Key usage of AWS Config is to monitor SG changes

Answer is B

Should be B AWS Config allows you to remediate noncompliant resources that are evaluated by AWS Config Rules. AWS Config applies remediation using AWS Systems Manager Automation documents. These documents define the actions to be performed on noncompliant AWS resources evaluated by AWS Config Rules. You can associate SSM documents by using AWS Management Console or by using APIs. AWS Config provides a set of managed automation documents with remediation actions. You can also create and associate custom automation documents with AWS Config rules. As it does give you an option to Setting Up Auto Remediation (Console) https://docs.aws.amazon.com/config/latest/developerguide/remediation.html#setup-autoremediation