AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsEasy
A security engineer needs to ensure that all network changes in their AWS environment are reviewed and approved before deployment. They want to implement a workflow that automatically flags any direct console or CLI changes to network configurations (e.g., Security Groups, Route Tables) that bypass their standard change management process. Which AWS service can be configured to detect and alert on these unauthorized direct changes?
- AAWS Config with Custom Config Rules.
- BAmazon GuardDuty with threat detection.
- CAWS CloudTrail with Amazon EventBridge rules.
- DAWS Security Hub with network findings.
Show answer & explanationAnswer & explanation
Correct answer: C. AWS CloudTrail with Amazon EventBridge rules.
AWS CloudTrail logs all API calls made to AWS services, including changes to network configurations. By creating Amazon EventBridge rules that filter CloudTrail events for specific network-related API calls (e.g., 'AuthorizeSecurityGroupIngress', 'CreateRoute'), the security team can receive real-time alerts for any direct changes that bypass their change management process.
Why the other options are wrong
- A. AWS Config monitors resource configurations for compliance, but while it can detect a *state* change, CloudTrail + EventBridge is more direct for *detecting the action* of a change bypassing a process.
- B. GuardDuty is a threat detection service that monitors for malicious activity, not for unauthorized changes to network configurations that bypass an internal process.
- D. Security Hub aggregates security findings but doesn't primarily detect custom unauthorized change actions by itself; it relies on other services like Config or GuardDuty for input.
Unauthorized Network Change Detection
Using AWS CloudTrail to log all AWS API calls and Amazon EventBridge to create rules that alert on specific network configuration changes made outside of approved processes.
- CloudTrail records all API actions.
- EventBridge filters and reacts to CloudTrail events.
- Essential for auditing and enforcing change management.
Memory trick: CloudTrail sees every step, EventBridge tells you if it's wrong.