Question

A security engineer at a retail company must continuously detect when engineers modify AWS security group rules or S3 bucket ACLs away from the approved baseline, and automatically flag those changes as non-compliant. The team already collects VPC flow logs and API activity separately. Which native cloud capability should the engineer implement to satisfy this specific requirement?

Accepted Answer

AWS Config with managed and custom rules to evaluate resource configuration against a desired baseline

Answer

Amazon CloudWatch metric alarms triggered on CPU and network utilization thresholds

Answer

AWS CloudTrail data events forwarded to an S3 bucket for long-term archival

Answer

Amazon GuardDuty threat detection analyzing DNS and flow log telemetry for malicious IPs