The company wants continuous monitoring to detect when any EC2 security group permits SSH from the public internet and to automatically close that port when detected. Which combination of actions should the SysOps administrator implement? (Choose two.)

AWS Config is the ideal service for continuously monitoring resource configurations, including security groups. An AWS Config managed rule like restricted-ssh can detect security groups that allow SSH (port 22) from 0.0.0.0/0 (the public internet). When this rule detects a non-compliant security group, it can trigger an action. AWS Systems Manager Automation runbooks are designed for automated remediation tasks. An Automation runbook can be configured to automatically modify the non-compliant security group, removing the overly permissive SSH rule. Incorrect options: CloudWatch alarms monitor metrics and logs, not resource configurations directly. While you could potentially create a custom metric, AWS Config is purpose-built for this type of compliance monitoring. Amazon Inspector is a vulnerability management service that assesses EC2 instances and applications for security vulnerabilities and deviations from best practices, but it doesn't directly monitor security group rules in real-time for compliance like AWS Config. AWS Systems Manager Run Command is for executing commands on EC2 instances, not for automated remediation of AWS resource configurations triggered by compliance violations.