AWS Certified Security – Specialty (SCS-C02) — Question 301
A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads.
A security engineer deploys an Amazon GuardDuty detector in the same AWS Region as the EC2 instances. The security engineer also sets up an AWS Security Hub integration with GuardDuty.
The security engineer needs to implement an automated solution to detect and appropriately respond to anomalous traffic patterns for the web application. The solution must comply with AWS best practices for initial response to security incidents and must minimize disruption to the web application.
Which solution will meet these requirements?
Answer options
- A. Create an Amazon EventBridge rule that detects the Behavior:EC2/TrafficVolumeUnusual GuardDuty finding. Configure the rule to invoke an AWS Lambda function to disable the EC2 instance profile access keys.
- B. Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Program the Lambda function to disassociate the identified instance from the Auto Scaling group and to isolate the instance by using a new restricted security group.
- C. Create a Security Hub automated response that updates the network ACL that is associated with the subnet of the EC2 instances. Configure the response to update the network ACL to deny traffic from the source of detected anomalous traffic.
- D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security engineer’s email address to the SNS topic. Configure GuardDuty to send all findings to the SNS topic.
Correct answer: B
Explanation
Option B is correct because isolating the compromised EC2 instance by detaching it from the Auto Scaling group and applying a restrictive security group allows for forensic analysis while minimizing service disruption. Option A is incorrect because EC2 instance profiles use temporary credentials rather than persistent access keys that can be disabled. Option C is incorrect because modifying the subnet network ACL would disrupt all other workloads sharing that subnet, and Option D is merely a notification mechanism rather than an automated response.