Exam AWS Certified Security - Specialty topic 1 question 427 discussion

Choosing C over A, quite a few reasons which others already stated, but a big one is that the question states "The company now needs ALL changes to security groups to initiate an alert to a specific company email address." Key-word being "ALL". I believe A would only notify of security group changes that made a sg non-compliant, whereas CloudTrail gives us a wider scope of activity.

i choose C https://aws.amazon.com/es/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/ A: focused on compliance management C: offers a faster way to detect changes to a security group’s configuration

The questions states that we are looking for the most operationally efficient method. Therefore C

C: In this post, Method 1 uses AWS Config to monitor changes to a security group’s configuration as part of an organization’s overall compliance auditing program. Method 1 views a change to a VPC security group as a compliance risk. Use this method when you want to bolster your company’s compliance management. Method 2 uses AWS CloudTrail and Amazon CloudWatch Events to identify AWS API calls that could change the configurations of VPC security groups. Method 2 views a change to a VPC security group as a potential security incident that should be identified in near real time. Use this method when you want to support your company’s monitoring of security operations. https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/

Both A and C works, however for the overall compliance A is efficient and for faster incident detection C is better. Here the company needs all changes to Security Group. https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/

A also includes remediation and the questions does not ask for it

Another reason for choosing C is the time it takes for the alert to get sent. I think A might take up to 4 hours while C would be nearly immediate.

MOST operationally efficient = less manual intervention. A requires manual remediation so from this standpoint C is better than A. Reference for the cloudwatch logs metric filter trigger alarm on sg change part : https://docs.fugue.co/FG_R00056.html

i choose A

C. Implement AWS CloudTrail. Configure forwarding to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter with a pattern match on all security group changes. Configure an Amazon CloudWatch alarm to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.

A and C are correct. A is more scalable in multi-account scenario. Though question doesnt explicitly state of multiple accounts but as a best practice, applications should be hosted in their own individual accounts. That implicit requirement points towards A

A & C correct but choose C

A and C are correct , I read this post and I Choose C https://aws.amazon.com/es/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/

Its between A or C. Choosing A.