SCS-C02 · Question #244
A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.070. The company wants to monitor compliance with this requirement at all times and wants…
The correct answer is B. Configure an Amazon EventBridge event rule that is invoked by a compliance change event from. AWS Config automatically generates compliance change events when a rule, such as the restricted-ssh managed rule, detects noncompliance. By setting up an Amazon EventBridge event rule that listens for compliance change events specifically related to this rule, you can quickly…
Question
A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.070. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notification if any security group is noncompliant. A security engineer has configured AWS Config and will use the restricted-ssh managed rule to monitor the security groups. What should the security engineer do next to meet these requirements?
Options
- AConfigure AWS Config to send its configuration snapshots to an Amazon S3 bucket. Create an
- BConfigure an Amazon EventBridge event rule that is invoked by a compliance change event from
- CConfigure AWS Config to push all its compliance notifications to Amazon CloudWatch Logs
- DConfigure an Amazon CloudWatch alarm on (he CloudWatch metric for the restricted-ssh
How the community answered
(64 responses)- A3% (2)
- B78% (50)
- C6% (4)
- D13% (8)
Explanation
AWS Config automatically generates compliance change events when a rule, such as the restricted-ssh managed rule, detects noncompliance. By setting up an Amazon EventBridge event rule that listens for compliance change events specifically related to this rule, you can quickly trigger a notification via Amazon SNS whenever a security group violates the rule. This provides near-real-time notifications with minimal operational overhead, directly addressing the
Topics
Community Discussion
No community discussion yet for this question.