ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Security - Specialty SCS-C02 All Questions

View all questions & answers for the AWS Certified Security - Specialty SCS-C02 exam
Go to Exam

Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 36 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02
Question #: 36
Topic #: 1
[All AWS Certified Security - Specialty SCS-C02 Questions]

A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an FTP server. A high number of clients from multiple locations contact the FTP server. GuardDuty identifies this activity as a brute force attack because of the high number of connections that happen every hour.
The company has flagged the finding as a false positive, but GuardDuty continues to raise the issue. A security engineer must improve the signal-to-noise ratio without compromising the company's visibility of potential anomalous behavior.
Which solution will meet these requirements?

  • A. Disable the FTP rule in GuardDuty in the Region where the FTP server is deployed.
  • B. Add the FTP server to a trusted IP list. Deploy the list to GuardDuty to stop receiving the notifications.
  • C. Create a suppression rule in GuardDuty to filter findings by automatically archiving new findings that match the specified criteria.
  • D. Create an AWS Lambda function that has the appropriate permissions to delete the finding whenever a new occurrence is reported.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by 100fold at Oct. 19, 2023, 6:21 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
100fold
Highly Voted 1 year, 1 month ago
Selected Answer: C
Answer C https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html
upvoted 6 times
...
FunkyFresco
Most Recent 3 months, 2 weeks ago
Selected Answer: C
Option C
upvoted 1 times
...
Raphaello
9 months ago
Selected Answer: C
Create a suppression rule for certain findings so it will be automatically fowarded to "Archive" and do not show up in Security Hub (if enabled), Detective, or EventBridge. Option C is correct.
upvoted 1 times
...
WeepingMaplte
12 months ago
Selected Answer: C
A suppression rule is a set of criteria, consisting of a filter attribute paired with a value, used to filter findings by automatically archiving new findings that match the specified criteria.
upvoted 2 times
...
Daniel76
1 year ago
Selected Answer: C
Suppression rule with specific criteria is the most appropriate solution. Disable FTP entirely, trust everything from the FTP server reduces the GuardDuty effectiveness. Creating lambda to delete the finding is counter productive and the finding might have already trigger SNS topic if there's one.
upvoted 3 times
...
Aamee
1 year ago
Selected Answer: C
Self-explanatory from the link provided below.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago