DOP-C02 practice question 20 of 35

A company hired a penetration tester to simulate an internal security breach The tester performed port scans on the company's Amazon EC2 instances…

A company hired a penetration tester to simulate an internal security breach The tester performed port scans on the company's Amazon EC2 instances. The company's security measures did not detect the port scans. The company needs a solution that automatically provides notification when port scans are performed on EC2 instances. The company creates and subscribes to an Amazon Simple Notification Service (Amazon SNS) topic. What should the company do next to meet the requirement?

Answer options

A: Ensure that Amazon GuardDuty is enabled Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic. Correct answer

B: Ensure that Amazon Inspector is enabled Create an Amazon EventBridge event for detected network reachability findings that indicate port scans Connect the event to the SNS topic.

C: Ensure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected CVEs that cause open port vulnerabilities. Connect the event to the SNS topic

D: Ensure that AWS CloudTrail is enabled Create an AWS Lambda function to analyze the CloudTrail logs for unusual amounts of traffic from an IP address range Connect the Lambda function to the SNS topic.

Correct Answer:

A. Ensure that Amazon GuardDuty is enabled Create an Amazon CloudWatch alarm for detected EC2 and port scan findings. Connect the alarm to the SNS topic.

Explanation

Ensure that Amazon GuardDuty is Enabled: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It can detect port scans and generate findings for these events. Create an Amazon CloudWatch Alarm for Detected EC2 and Port Scan Findings: Configure GuardDuty to monitor for port scans and other threats. Create a CloudWatch alarm that triggers when GuardDuty detects port scan activities. Connect the Alarm to the SNS Topic: The CloudWatch alarm should be configured to send notifications to the SNS topic subscribed by the security team. This setup ensures that the security team receives near-real-time notifications when a port scan is detected on the EC2 instances. Example configuration steps: Enable GuardDuty and ensure it is monitoring the relevant AWS accounts. Create a CloudWatch alarm:
{
"AlarmName": "GuardDutyPortScanAlarm", "MetricName": "ThreatIntelIndicator", "Namespace": "AWS/GuardDuty", "Statistic": "Sum", "Dimensions": [
{
"Name": "FindingType", "Value": "Recon:EC2/Portscan"
}
], "Period": 300, "EvaluationPeriods": 1, "Threshold": 1, "ComparisonOperator": "GreaterThanOrEqualToThreshold", "AlarmActions": ["arn:aws:sns:region:account-id:SecurityAlerts"]
}
Reference: Amazon GuardDuty Creating CloudWatch Alarms for GuardDuty Findings

Keep practicing

Take the free DOP-C02 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test