Q92 — AWS SAA-C03 Ch.10

Question 92 of 100 | ← Chapter 10

Q692. A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible.What should the solutions architect do to meet these requirements with the LEAST operational overhead?

• A. Write an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one
• B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created ✓
• C. Create an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a use
• D. Configure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions

Correct Answer: B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created

Explanation

To meet the requirements of providing an automated solution for a company's compliance policy that prohibits security group rules allowing SSH from 0.0.0.0/0, while also notifying the company of any policy breaches with the least operational overhead, a solutions architect should:B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created.Option B is the most suitable solution for meeting the requirements with the least operational overhead:- Enable the restricted-ssh AWS Config managed rule: The restricted-ssh rule is a preconfigured rule in AWS Config that checks for security group rules allowing SSH from 0.0.0.0/0. By enabling this rule, AWS Config will automatically evaluate the security groups and detect any noncompliant rules.- Generate an Amazon SNS notification when a noncompliant rule is created: AWS Config can be configured to send notifications to Amazon SNS when a noncompliant resource is detected. By setting up an SNS topic and configuring AWS Config to send notifications to that topic, the company can receive immediate notifications when a security group violates the compliance policy.Option A, writing an AWS Lambda script to monitor security groups for SSH open to 0.0.0.0/0 and create notifications, requires developing and maintaining a custom script, which adds operational overhead.Option C, creating an IAM role with permissions to globally open security groups and network ACLs and generating notifications when the role is assumed, goes against the compliance policy and may introduce security risks.Option D, configuring a service control policy (SCP) to prevent non-administrative users from creating or editing security groups and creating notifications in the ticketing system when a user requests an administrator permission, does not directly address the policy breach of SSH from 0.0.0.0/0 and may introduce additional complexity.Therefore, the best approach is B: Enable the restricted-ssh AWS Config managed rule and generate an Amazon SNS notification when a noncompliant rule is created. This solution provides an automated and scalable solution to enforce the compliance policy, detect policy breaches, and notify the company with minimal operational overhead.