ExamPark
Course menuSOA-C03

Exams / SOA-C03 / AWS Config and compliance monitoring / Question 1

SOA-C03 practice question: AWS Config and compliance monitoring (1 of 2)

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A public library's security standard says no security group may allow SSH from 0.0.0.0/0. Staff sometimes add such rules while troubleshooting and forget to remove them. The library wants any security group that breaks the rule to be found and fixed automatically within minutes, with a compliance history for its auditors. Which solution meets these requirements with the LEAST custom code?

Choose one answer.

  1. A. Turn on GuardDuty, and create a suppression rule that archives findings about security groups with open SSH access.
  2. B. Turn on the AWS Config restricted-ssh managed rule with automatic remediation that runs the AWS-DisablePublicAccessForSecurityGroup runbook.
  3. C. Write a Lambda function that runs every hour, lists all security groups, and removes any rule that allows SSH from 0.0.0.0/0.
  4. D. Run Amazon Inspector network reachability scans each week and have staff remove the rules that the findings report.
Show the answer and explanation

Answer: B

Explanation

AWS Config managed rules check resource configurations as they change and keep a compliance timeline that auditors can review. Attaching automatic remediation with a Systems Manager Automation runbook fixes noncompliant resources without custom code. GuardDuty and Inspector are detection services for threats and vulnerabilities, not configuration compliance tools.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SOA-C03 practice examPractice AWS Config and compliance monitoringAll AWS Config and compliance monitoring questions