A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents.
A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly. Which combination of actions would build the required solution? (Choose three.)

Question

A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents.

A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance; the Security team must be notified quickly. Which combination of actions would build the required solution? (Choose three.)

Alex Fill · Accepted Answer

Enable AWS Trusted Advisor and activate email notifications for an email address assigned to the security contact.

Alex Fill · Accepted Answer

Invoke an AWS Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.

Alex Fill · Accepted Answer

Configure event notifications on S3 buckets for PUT; POST, and DELETE events.

Alex Fill · Answer

Configure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.

Alex Fill · Answer

Enable Amazon GuardDuty in the security account. and join the production accounts as members.

Alex Fill · Answer

Configure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 93 - SCS-C01 discussion

Suggested answer: D, E, F

0 comments