Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Security - Specialty SCS-C02 All Questions

View all questions & answers for the AWS Certified Security - Specialty SCS-C02 exam
Go to Exam

Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 36 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02
Question #: 36
Topic #: 1
[All AWS Certified Security - Specialty SCS-C02 Questions]

A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an FTP server. A high number of clients from multiple locations contact the FTP server. GuardDuty identifies this activity as a brute force attack because of the high number of connections that happen every hour.
The company has flagged the finding as a false positive, but GuardDuty continues to raise the issue. A security engineer must improve the signal-to-noise ratio without compromising the company's visibility of potential anomalous behavior.
Which solution will meet these requirements?

  • A. Disable the FTP rule in GuardDuty in the Region where the FTP server is deployed.
  • B. Add the FTP server to a trusted IP list. Deploy the list to GuardDuty to stop receiving the notifications.
  • C. Create a suppression rule in GuardDuty to filter findings by automatically archiving new findings that match the specified criteria.
  • D. Create an AWS Lambda function that has the appropriate permissions to delete the finding whenever a new occurrence is reported.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by 100fold at Oct. 19, 2023, 6:21 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Submit Cancel
100fold
Highly Voted 11 months, 3 weeks ago
Selected Answer: C
Answer C https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html
upvoted 6 times
...
FunkyFresco
Most Recent 1 month, 2 weeks ago
Selected Answer: C
Option C
upvoted 1 times
...
Raphaello
7 months ago
Selected Answer: C
Create a suppression rule for certain findings so it will be automatically fowarded to "Archive" and do not show up in Security Hub (if enabled), Detective, or EventBridge. Option C is correct.
upvoted 1 times
...
WeepingMaplte
9 months, 4 weeks ago
Selected Answer: C
A suppression rule is a set of criteria, consisting of a filter attribute paired with a value, used to filter findings by automatically archiving new findings that match the specified criteria.
upvoted 2 times
...
Daniel76
10 months, 1 week ago
Selected Answer: C
Suppression rule with specific criteria is the most appropriate solution. Disable FTP entirely, trust everything from the FTP server reduces the GuardDuty effectiveness. Creating lambda to delete the finding is counter productive and the finding might have already trigger SNS topic if there's one.
upvoted 3 times
...
Aamee
10 months, 1 week ago
Selected Answer: C
Self-explanatory from the link provided below.
upvoted 1 times
...

Get IT Certification

Unlock free, top-quality video courses on ExamTopics with a simple registration. Elevate your learning journey with our expertly curated content. Register now to access a diverse range of educational resources designed for your success. Start learning today with ExamTopics!

Start Learning for free
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel