A retail company wants to secure its AWS infrastructure by auditing all API activities and setting up real-time monitoring for unauthorized access attempts. The security team needs to track who made API calls to modify security group rules and also detect if any Amazon EC2 instances are communicating with known malicious IP addresses.
Which AWS services should the company implement to meet these security requirements? (Select TWO)
- AWS CloudTrail to track and audit all API operations and console actions.Answer
- Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.Answer
- CAmazon CloudWatch to automatically log all API history and trace administrative configuration changes.
- DAmazon Inspector to continuously scan active network traffic for outbound connections to malicious hosts.
- EAWS Support to actively audit user console logins and block unauthorized network packets.
Answer
AWS CloudTrail to track and audit all API operations and console actions, and Amazon GuardDuty to monitor network activity and detect potential threats like communication with malicious IP addresses.
The correct options are the statements describing AWS CloudTrail and Amazon GuardDuty. AWS CloudTrail is the primary service for auditing, security monitoring, and operational troubleshooting of AWS API activity, making it the correct choice for tracking who modified security groups. Amazon GuardDuty uses intelligent threat detection to continuously monitor for malicious behavior, including identifying when EC2 instances communicate with known malicious IP addresses.
Step-by-Step Solution
Key Concept
AWS security logging and monitoring services have distinct roles: AWS CloudTrail logs API activity for compliance and auditing, while Amazon GuardDuty acts as an intelligent threat detection service using machine learning and threat intelligence feeds.