SOA-C03 · Question #90
A company hosts an FTP server on Amazon EC2 instances. In the company's AWS environment, AWS Security Hub sends findings for the EC2 instances to Amazon EventBridge because the FTP port has become…
The correct answer is D. Configure the existing EventBridge event to invoke an AWS Lambda function. Configure the. Security Hub already sends findings to Amazon EventBridge, so the most efficient event-driven remediation is to have EventBridge trigger a Lambda function whenever a relevant finding (publicly exposed port) occurs. The Lambda function can parse the finding, identify the…
Question
A company hosts an FTP server on Amazon EC2 instances. In the company’s AWS environment, AWS Security Hub sends findings for the EC2 instances to Amazon EventBridge because the FTP port has become publicly exposed in the security groups that are attached to the instances. A CloudOps engineer wants an automated solution to remediate the Security Hub finding and any similar exposed port findings. The CloudOps engineer wants to use an event-driven approach. Which solution will meet these requirements?
Options
- AConfigure the existing EventBridge event to stop the EC2 instances that have the exposed port.
- BCreate a cron job for the FTP server to invoke an AWS Lambda function. Configure the Lambda
- CCreate a cron job for the FTP server that invokes an AWS Lambda function. Configure the
- DConfigure the existing EventBridge event to invoke an AWS Lambda function. Configure the
How the community answered
(37 responses)- A14% (5)
- B5% (2)
- C8% (3)
- D73% (27)
Explanation
Security Hub already sends findings to Amazon EventBridge, so the most efficient event-driven remediation is to have EventBridge trigger a Lambda function whenever a relevant finding (publicly exposed port) occurs. The Lambda function can parse the finding, identify the affected security group and port, and remove the 0.0.0.0/0 (or ::/0) rule that exposes the port. This directly fixes the root cause (the security group rule) and can be reused for similar exposed-port findings without manual intervention or periodic jobs.
Topics
Community Discussion
No community discussion yet for this question.