AWS Certified DevOps Engineer – Professional (DOP-C02) — Question 288
A security team must record the configuration of AWS resources, detect issues, and send notifications for findings. The main workload in the AWS account consists of an Amazon EC2 Auto Scaling group that scales in and out several times during the day.
The team wants to be notified within 2 days if any Amazon EC2 security group allows traffic on port 22 for 0.0.0.0/0. The team also needs a snapshot of the configuration of the AWS resources to be taken routinely.
The security team has already created and subscribed to an Amazon Simple Notification Service (Amazon SNS) topic.
Which solution meets these requirements?
Answer options
- A. Configure AWS Config to use periodic recording for the AWS account. Deploy the vpc-sg-port-restriction-check AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
- B. Configure AWS Config to use configuration change recording for the AWS account. Deploy the vpc-sg-open-only-to-authorized-ports AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
- C. Configure AWS Config to use configuration change recording for the AWS account. Deploy the ssh-restricted AWS Config managed rule. Configure AWS Config to use the SNS topic as the target for notifications.
- D. Create an AWS Lambda function to evaluate security groups and publish a message to the SNS topic. Use an Amazon EventBridge rule to schedule the Lambda function to run once a day.
Correct answer: C
Explanation
AWS Config with configuration change recording is ideal for tracking dynamic environments like Auto Scaling groups, as it records changes as they occur and can deliver configuration snapshots. The ssh-restricted AWS Config managed rule specifically checks whether security groups block incoming SSH traffic on port 22 from 0.0.0.0/0, directly addressing the security requirement. Other options either use incorrect managed rules or rely on custom Lambda functions that do not inherently provide the required resource configuration recording and snapshot capabilities.