Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 339 discussion

ssh-restricted

Why not B? https://docs.aws.amazon.com/config/latest/developerguide/vpc-sg-open-only-to-authorized-ports.html

i think we need to use periodic or daily recording instead of continuous one

For monitoring if any EC2 security group allows traffic on port 22 (SSH) from 0.0.0.0/0: Use the managed AWS Config rule: restricted-ssh This rule checks that security groups do not allow unrestricted incoming SSH traffic (port 22) from 0.0.0.0/0.

"A" because "vpc-sg-port-restriction-check" fits requested check well, and the condition says "... to be taken routinely", which means "periodically", "regularly". "B" and "C" propose running "on-change" instead, which does not fit condition "routinely"

Configuration Change Recording: By configuring AWS Config to use configuration change recording, the system will continuously monitor and record configurations of your AWS resources whenever there are changes. This ensures real-time compliance monitoring and reduces the delay in detection. Appropriate Managed Rule: The ssh-restricted AWS Config managed rule specifically checks for security groups that allow unrestricted SSH (port 22) access. This rule directly addresses the requirement to be notified if any EC2 security group allows traffic on port 22 for 0.0.0.0/0. Notification Setup: Configuring AWS Config to use the SNS topic ensures that the security team will be notified within the specified time frame if the rule is violated. AWS Config can send notifications to the SNS topic as soon as a non-compliant resource is detected.

The correct answer is C