nerdexam
Amazon

SCS-C02 · Question #244

A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.070. The company wants to monitor compliance with this requirement at all times and wants…

The correct answer is B. Configure an Amazon EventBridge event rule that is invoked by a compliance change event from. AWS Config automatically generates compliance change events when a rule, such as the restricted-ssh managed rule, detects noncompliance. By setting up an Amazon EventBridge event rule that listens for compliance change events specifically related to this rule, you can quickly…

Submitted by minji_kr· Mar 6, 2026Security Logging and Monitoring

Question

A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.070. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notification if any security group is noncompliant. A security engineer has configured AWS Config and will use the restricted-ssh managed rule to monitor the security groups. What should the security engineer do next to meet these requirements?

Options

  • AConfigure AWS Config to send its configuration snapshots to an Amazon S3 bucket. Create an
  • BConfigure an Amazon EventBridge event rule that is invoked by a compliance change event from
  • CConfigure AWS Config to push all its compliance notifications to Amazon CloudWatch Logs
  • DConfigure an Amazon CloudWatch alarm on (he CloudWatch metric for the restricted-ssh

How the community answered

(64 responses)
  • A
    3% (2)
  • B
    78% (50)
  • C
    6% (4)
  • D
    13% (8)

Explanation

AWS Config automatically generates compliance change events when a rule, such as the restricted-ssh managed rule, detects noncompliance. By setting up an Amazon EventBridge event rule that listens for compliance change events specifically related to this rule, you can quickly trigger a notification via Amazon SNS whenever a security group violates the rule. This provides near-real-time notifications with minimal operational overhead, directly addressing the

Topics

#AWS Config#EventBridge#compliance monitoring#security groups

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice