An internet-facing ALB and private subnets must be audited.
Check WAF, Shield, Network Firewall, and security-group protection against one standard.
Which audit approach is most appropriate?
Use Security Hub standards to aggregate findings and AWS Config rules to continuously evaluate resource settings.
Detailed explanation
An authentication policy change is not a network-protection audit.
An authentication policy change is not a network-protection audit.
Cache performance does not verify network-protection configuration.
Cache performance does not verify network-protection configuration.
Reachability does not audit defensive rules or public-access settings.
Reachability does not audit defensive rules or public-access settings.
Security Hub aggregates findings and standard compliance, while Config evaluates resource configuration continuously.
Security Hub aggregates findings and standard compliance, while Config evaluates resource configuration continuously.
Check official documentation
Compare the following points with the official documentation.
AWS Security Hub security standards and AWS Config network security rulesの公式説明を確認する。
What to confirm
Security Hubの検出集約とConfigの設定評価を区別できる。
Key points
- Security Hub
- AWS Config
- Security standard
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Findings versus configuration
Security Hub summarizes findings, while Config can evaluate the actual resource setting.
Defense in depth
WAF, Shield, Firewall, and security groups protect different traffic layers and should not be conflated.