SOA-C02 · Question #126
A company hosts an internal application on Amazon EC2 instances. All application data and requests route through an AWS Site-to-Site VPN connection between the on-premises network and AWS. The…
The correct answer is A. Create an AWS Lambda function that updates security groups that are associated with the. Option A is correct because it uses an event-driven Lambda function triggered in real time when a security group change is detected (via EventBridge), and the function automatically reverts or updates the offending security group rule. This satisfies both requirements…
Question
A company hosts an internal application on Amazon EC2 instances. All application data and requests route through an AWS Site-to-Site VPN connection between the on-premises network and AWS. The company must monitor the application for changes that allow network access outside of the corporate network. Any change that exposes the application externally must be restricted automatically. Which solution meets these requirements in the MOST operationally efficient manner?
Options
- ACreate an AWS Lambda function that updates security groups that are associated with the
- BCreate a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule that targets an
- CConfigure AWS Config and a custom rule to monitor whether a security group allows inbound
- DConfigure AWS Config and the managed rule for monitoring public IP associations with the
How the community answered
(51 responses)- A43% (22)
- B18% (9)
- C31% (16)
- D8% (4)
Explanation
Option A is correct because it uses an event-driven Lambda function triggered in real time when a security group change is detected (via EventBridge), and the function automatically reverts or updates the offending security group rule. This satisfies both requirements simultaneously - monitoring and automatic restriction - with no manual intervention and minimal operational overhead.
Option B is wrong because a scheduled EventBridge rule introduces a polling delay, meaning the application could remain externally exposed for minutes or hours between checks. Real-time detection is required here.
Option C is wrong because writing a custom AWS Config rule carries significantly more development and maintenance burden than necessary. A managed rule or a simpler Lambda-based remediation pattern is operationally cheaper.
Option D is wrong because monitoring public IP associations detects whether an EC2 instance has a public IP, which is a separate concern from whether a security group rule actually permits inbound traffic from outside the corporate network. A security group change is the actual threat vector here.
Memory tip: When a question demands automatic restriction (not just alerting) and mentions most operationally efficient, look for event-driven Lambda remediation - "detect and fix instantly" beats "schedule and check later" or "detect but don't fix."
Topics
Community Discussion
No community discussion yet for this question.