Examkin

Question

Difficulty: HardSecurity Logging, Monitoring, and Auditing

A global organization wants to implement a robust security logging and auditing architecture. They need to meet three distinct security and operational monitoring objectives:

1. They must track and log all management events and API calls across their entire AWS Organization for compliance auditing.
2. They need to monitor CPU utilization and disk read/write metrics of their Amazon EC2 instances to dynamically scale resources and trigger operational alerts.
3. They require intelligent threat detection that uses machine learning to continuously analyze metadata logs (such as VPC Flow Logs and DNS logs) to identify potential malicious activity.

Which combination of AWS services should the organization implement to satisfy these requirements?

  1. AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and Amazon GuardDuty for intelligent threat detectionAnswer
  2. B
    Amazon CloudWatch for tracking organizational API calls, AWS CloudTrail for EC2 performance metrics and triggering operational alerts, and Amazon GuardDuty for intelligent threat detection
  3. C
    AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and Amazon Inspector for intelligent threat detection
  4. D
    AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and relying on AWS to automatically identify and block host-level application attacks as part of its infrastructure security responsibility

Answer

AWS CloudTrail for tracking organizational API calls, Amazon CloudWatch for EC2 performance metrics and triggering operational alerts, and Amazon GuardDuty for intelligent threat detection
The correct service mapping matches each requirement: AWS CloudTrail logs management events and API actions centrally; Amazon CloudWatch monitors resource performance metrics (like CPU and disk read/write) and handles alarms; Amazon GuardDuty provides intelligent, machine learning-driven threat detection by analyzing VPC Flow Logs, DNS logs, and CloudTrail events.

Step-by-Step Solution

1
Analyze the first requirement: tracking and logging all management events and API calls across the AWS Organization for compliance.
Identify AWS CloudTrail as the service designed to record API calls, console actions, and management events.
AWS CloudTrail provides governance, compliance, operational auditing, and risk auditing of your AWS account actions.
2
Analyze the second requirement: monitoring CPU utilization and disk metrics of Amazon EC2 instances to scale resources and trigger alerts.
Identify Amazon CloudWatch as the monitoring and observability service that collects performance metrics and sets alarms.
Amazon CloudWatch tracks raw metrics from AWS resources and allows the creation of alarms and scaling actions based on those metrics.
3
Analyze the third requirement: intelligent threat detection using machine learning to analyze VPC Flow Logs, DNS logs, and CloudTrail events.
Identify Amazon GuardDuty as the intelligent threat detection service.
Amazon GuardDuty continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior using log sources.

Key Concept

Selecting appropriate logging, monitoring, and threat detection services in AWS based on functional and security requirements.
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic