AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 13
A security consultant has identified unnecessary security group and network ACL rules that pose a security risk. What steps should a SysOps Administrator take to resolve the security vulnerabilities?
-
A
Create an AWS WAF web ACL that protects resources from web attacks.
-
B
Use Amazon Inspector to identify security best practices and rectify issues.
-
C
Remove the unnecessary security group rules and network ACL rules.
-
D
Contact AWS Support and notify them of the vulnerabilities.
Reveal correct answer
Correct answer: C
Explanation
This question is partly technical and partly about the shared responsibility model. The unnecessary rules are part of the security in the cloud which is a customer responsibility so there’s no need to contact AWS support. The easiest way to resolve the vulnerability issues is for the SysOps Administrator to remove the rules.
CORRECT: "Remove the unnecessary security group rules and network ACL rules" is the correct answer.
INCORRECT: "Contact AWS Support and notify them of the vulnerabilities" is incorrect. This is not a responsibility of AWS Support as it constitutes security in the cloud.
INCORRECT: "Create an AWS WAF web ACL that protects resources from web attacks" is incorrect. AWS WAF can assist with protecting certain resources such as CloudFront distributions, ALBs and API Gateways. However, it cannot resolve issues with security group and network ACL rules.
INCORRECT: "Use Amazon Inspector to identify security best practices and rectify issues" is incorrect. Inspector offers best practice guidance, but it will not rectify unnecessary rules.
References:
https://aws.amazon.com/compliance/shared-responsibility-model
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
