The security engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks…

Question

Options

• AUse AWS Certificate Manager to encrypt all traffic between the client and application servers.
• BReview the application security groups to ensure that only the necessary ports are open.
• CUse Elastic Load Balancing to offload Secure Sockets Layer encryption.
• DUse Amazon Inspector to periodically scan the backend instances.
• EUse AWS Key Management Service (AWS KMS) to encrypt all the traffic between the client and

• A
  4% (1)
• B
  85% (23)
• C
  4% (1)
• E
  7% (2)

Explanation

B and D directly address the two stated goals: limiting the attack surface and checking for known vulnerabilities. Reviewing security groups (B) reduces the attack surface by closing ports that don't need to be open - fewer open ports means fewer entry points for attackers. Amazon Inspector (D) is purpose-built to scan EC2 instances for known CVEs and software vulnerabilities on a scheduled basis, which directly answers the "check for vulnerabilities" requirement.

The distractors all involve encryption, not attack surface or vulnerability scanning. ACM (A) and ELB SSL offloading (C) manage TLS certificates and traffic encryption, which protects data in transit but does nothing to harden the instances or close unnecessary ports. KMS (E) manages cryptographic keys for encrypting data at rest or generating data keys - it is not used to encrypt network traffic, making it doubly wrong.

Memory tip: Think "BD = Block + Detect" - Block unnecessary access with security groups, Detect vulnerabilities with Inspector. Any answer involving encryption (ACM, ELB SSL offload, KMS) is solving a confidentiality problem, not an attack surface problem.

No community discussion yet for this question.