SOA-C02 · Question #585
A company runs applications on Amazon EC2 instances. The company wants to ensure that the SSH ports on the EC2 instances are never open. The company already has enabled AWS Config and has set up the…
The correct answer is B. Configure the AWS Config rule to identify noncompliant security groups. Configure the rule to use. Option B is correct because AWS Config supports automatic remediation using AWS Systems Manager (SSM) Automation documents. When the restricted-ssh rule flags a noncompliant security group, SSM Automation (e.g., the AWS-DisablePublicAccessForSecurityGroup runbook) can be…
Question
A company runs applications on Amazon EC2 instances. The company wants to ensure that the SSH ports on the EC2 instances are never open. The company already has enabled AWS Config and has set up the restricted-ssh AWS managed rule. A SysOps administrator must implement a solution to remediate SSH port access for noncompliant security groups of the EC2 instances. Which solution will meet this requirement with the MOST operational efficiency?
Options
- AConfigure the AWS Config rule to identify noncompliant security groups. Configure the rule to use
- BConfigure the AWS Config rule to identify noncompliant security groups. Configure the rule to use
- CMake an AWS Config API call to search for noncompliant security groups. Disable SSH access
- DConfigure the AWS Config rule to identify noncompliant security groups. Manually update each
How the community answered
(47 responses)- A9% (4)
- B85% (40)
- C4% (2)
- D2% (1)
Explanation
Option B is correct because AWS Config supports automatic remediation using AWS Systems Manager (SSM) Automation documents. When the restricted-ssh rule flags a noncompliant security group, SSM Automation (e.g., the AWS-DisablePublicAccessForSecurityGroup runbook) can be triggered automatically to remove the offending SSH rule - no human intervention required, making it the most operationally efficient solution.
Option A is wrong because it likely involves a Lambda-based remediation, which requires writing, deploying, and maintaining custom function code - more operational overhead than using a built-in SSM Automation document.
Option C is wrong because manually making API calls to search for noncompliant groups and then disabling SSH is a reactive, human-driven process with no automation, which is the opposite of operational efficiency.
Option D is wrong because manually updating each noncompliant security group is the least efficient approach - it does not scale and requires ongoing administrator effort every time a violation occurs.
Memory tip: Think "Config detects, SSM fixes." Whenever an AWS exam asks about automated remediation for Config rules, the answer almost always involves SSM Automation as the remediation action - it's the native, no-code integration AWS designed for this exact pattern.
Topics
Community Discussion
No community discussion yet for this question.