Q77 — AWS SAA-C03 Ch.12

Question 77 of 100 | ← Chapter 12

Q877. A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture.What should a solutions architect do next to protect against threats?

• A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules. ✓
• B. Use AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
• C. Use Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
• D. Use Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.

Correct Answer: A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.

Explanation

To protect against threats in the AWS environment, given the existing architecture with AWS WAF, the recommended next steps for a solutions architect are:A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and invoke an AWS Lambda function to adjust the AWS WAF rules.Here's why:Option A suggests using Amazon GuardDuty to perform threat detection. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify suspicious activity and potential threats in AWS environments. By enabling GuardDuty, the company can gain visibility into potential security issues in real-time.Configuring Amazon EventBridge to filter for GuardDuty findings allows for fine-grained control over the events generated by GuardDuty. By filtering the events, the solutions architect can focus on specific types of findings that are relevant to the web application's security.Invoking an AWS Lambda function in response to GuardDuty findings provides the ability to automate the adjustment of AWS WAF rules. The Lambda function can programmatically update the WAF rules to block or allow specific traffic based on the detected threats. This allows the company to respond quickly and automatically to suspicious or unexpected behavior in the environment.Option B suggests using AWS Firewall Manager to perform threat detection. AWS Firewall Manager is a service that provides centralized management of AWS WAF rules across multiple accounts and resources. However, in the given scenario, the focus is on protecting the web application specifically with AWS WAF, and AWS Firewall Manager may not be necessary unless there are requirements for managing WAF rules across multiple accounts.Option C suggests using Amazon Inspector to perform threat detection and update the AWS WAF rules. While Amazon Inspector is a valuable security assessment service, it is primarily used for vulnerability assessment and compliance checking rather than real-time threat detection. Additionally, the option mentions creating a VPC network ACL to limit access to the web application, which is a good practice but not directly related to automatic threat detection and response.Option D suggests using Amazon Macie to perform threat detection and update the AWS WAF rules. However, Amazon Macie is a service primarily focused on data discovery and data loss prevention, particularly for sensitive data. It is not specifically designed for real-time threat detection and responding to suspicious behavior in the AWS environment.In summary, the most appropriate next steps for protecting against threats in the AWS environment, given the existing architecture with AWS WAF, are to use Amazon GuardDuty for threat detection, configure Amazon EventBridge to filter for GuardDuty findings, and invoke an AWS Lambda function to adjust the AWS WAF rules (Option A). This combination allows for real-time threat detection and automated response to suspicious or unexpected behavior in the environment.