How Do You Find Security Groups Open to the Internet on Port 3389?
A company needs to view a list of security groups that are open to the internet on port 3389. What should a CloudOps engineer do to meet this requirement?
Community Insight
The question tests which AWS service performs configuration-level inspection of security group rules, and the trap is choosing a threat-detection or policy-guardrail service that never enumerates open ports.
AWS Trusted Advisor's security group check reports security groups whose inbound rules allow unrestricted access on ports such as 22 and 3389. This page confirms Trusted Advisor as the correct tool and explains why GuardDuty, SCPs, and IAM Access Analyzer cannot produce this list.
Many candidates pick GuardDuty because it sounds security-related, but GuardDuty detects malicious activity and recon behavior at runtime; it does not inventory security group rules for unrestricted RDP access.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Trusted Advisor includes a security check that inspects security group inbound rules and flags groups that allow unrestricted access (0.0.0.0/0 or::/0) on high-risk ports, including 22 (SSH) and 3389 (RDP). Running that check returns exactly the deliverable the company asked for: a list of security groups open to the internet on port 3389. Trusted Advisor is a best-practice and configuration inspection service, so no agents, packet capture, or workload traffic is required. As Bad_Mat noted, you "Use AWS Trusted Advisor to find security groups that allow unrestricted access on port 3389."
Why the Other Options Are Wrong
Amazon GuardDuty is a threat-detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious or anomalous behavior; it does not scan and enumerate security group rules, so option A describes a capability GuardDuty does not have. An AWS service control policy is an Organizations guardrail that allows or denies API actions — it can prevent someone from creating an open rule, but it cannot report existing groups, making B incorrect. IAM Access Analyzer evaluates resource-based policies such as bucket policies and role trust policies to find external access, not security group ingress rules on EC2 instances, so C misstates its purpose. Only Trusted Advisor provides the requested security group rule inventory.
Community Comment Notes
The single community response on this question, from Bad_Mat, endorses option D and describes it plainly as using Trusted Advisor to find security groups with unrestricted access on port 3389. That aligns with the documented behavior of the Trusted Advisor security group check and with the wording of the question, which asks for a list rather than for prevention or detection. No commenter argued for GuardDuty, SCPs, or IAM Access Analyzer, so there is no credible counter-position to weigh against the documented capability.
Official Reference
Exam Strategy
When a question asks you to identify or list misconfigured resources, look for the inspection and best-practice service (Trusted Advisor, AWS Config, Security Hub) rather than a detection or guardrail service. GuardDuty detects behavior, SCPs prevent actions, and IAM Access Analyzer evaluates resource policies — none of them enumerate security group ingress rules.
Frequently Asked Questions
Why can't GuardDuty list security groups open on port 3389?
GuardDuty analyzes flow logs, DNS logs, and CloudTrail events for malicious activity. It detects behavior such as port scanning but does not inventory security group ingress rules.
Can an SCP identify security groups with unrestricted RDP access?
No. An SCP is a permissions guardrail that allows or denies API actions across an organization; it does not scan or report existing security group rules.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →