A university must continuously detect security groups that allow 0.0.0.0/0 on port 22 and show each group as noncompliant until that rule is gone. A weekly look at the console is not enough. Which service should they use for the ongoing evaluation?
Select an answer to reveal the explanation.
Short Explanation
You want a referee who keeps watching the security group, not a photo from last Friday. Config is that referee: the group stays noncompliant until the open SSH rule is gone. Flow logs can show traffic later, and they never score the rule itself.
Full Explanation
AWS Config records configuration and evaluates it with rules on a continuous basis. A rule for SSH open to the world marks the security group noncompliant and clears it only after the group changes, which is the ongoing result the university described. A single Trusted Advisor export is a point-in-time check, and the stem says it will not be repeated. VPC Flow Logs show accepted and rejected packets; they do not record the security group as a compliance state. CloudTrail lookup shows who changed a group in the past; it does not keep a noncompliant flag until the rule is removed. Caveat: Config has to be recording in the Region, or the rule has nothing to evaluate. Operational check: open a test group to the world on port 22, confirm the rule goes noncompliant, remove the ingress, and confirm it returns to compliant.