SOA-C02 Practice Question 7: Config Auto Remediation Security Group
AWS Certified SysOps Administrator – Associate (SOA-C02) · Test 1 · question 7 of 10
Auditors repeatedly find security groups in several accounts that allow inbound TCP port 22 from 0.0.0.0/0. Developers create these rules by hand during troubleshooting and forget to remove them. A SysOps administrator must detect every such rule and revoke it automatically, without writing or maintaining custom code, and must retain an auditable record of each violation and its correction.
Which solution meets these requirements?
Show answer and explanation
Answer:
AWS Config evaluates resource configurations against rules and records the compliance result in a timeline, which satisfies the audit requirement. The managed rule restricted-ssh flags any security group that permits unrestricted inbound SSH. AWS Config remediation associates an AWS Systems Manager Automation runbook with a rule; setting it to automatic execution means the AWS-DisablePublicAccessForSecurityGroup runbook revokes the offending rule as soon as the resource is found noncompliant. Both the rule and the runbook are AWS managed, so no custom code exists to maintain.
Option A detects nothing here. GuardDuty analyses threat activity such as suspicious API calls and network behaviour; an open security group is a configuration state, not a finding, and the option only notifies rather than remediating.
Option B breaks legitimate work. Denying AuthorizeSecurityGroupIngress outright stops teams from creating any inbound rule, and IAM policies for that action cannot be conditioned on the CIDR being authorized, so a narrower deny is not available.
Option C reports observed traffic after the fact, not the misconfiguration, and requires someone to read the query output and act. Nothing is remediated automatically.
Reference: Remediating noncompliant resources with AWS Config rules