A company hosts an FTP server on EC2 instances. AWS Security Hub sends findings to Amazon EventBridge when the FTP port becomes publicly exposed in attached security groups. A CloudOps engineer…

Question

Options

• AConfigure the existing EventBridge event to stop the EC2 instances that have the exposed port.
• BCreate a cron job for the FTP server to invoke an AWS Lambda function. Configure the Lambda
• CCreate a cron job for the FTP server that invokes an AWS Lambda function. Configure the
• DConfigure the existing EventBridge event to invoke an AWS Lambda function. Configure the

• A
  15% (6)
• B
  5% (2)
• C
  8% (3)
• D
  72% (28)

Explanation

Per the AWS Cloud Operations and Security Automation documentation, Security Hub integrates with Amazon EventBridge to publish findings in real time. These events can trigger automated responses using AWS Lambda functions or AWS Systems Manager Automation runbooks. In this scenario, the correct CloudOps approach is to configure the existing EventBridge rule to invoke a Lambda function that inspects the event payload, identifies the affected security group, and removes the offending inbound rule (e.g., port 21 open to 0.0.0.0/0). This event-driven remediation provides continuous compliance and eliminates manual intervention. Cron jobs (Options B and C) contradict event-driven design and add operational overhead. Stopping instances (Option A) doesn't address the root cause -- the insecure security Thus, Option D aligns with AWS best practices for automated security remediation through EventBridge and Lambda.

No community discussion yet for this question.