Examkin

Question

Difficulty: EasySecurity Logging, Monitoring, and Auditing

A logistics provider wants to identify potential security threats and malicious activity across their AWS accounts by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. Which AWS service should they use for this continuous threat monitoring?

  1. A
    AWS CloudTrail
  2. B
    Amazon CloudWatch
  3. Amazon GuardDutyAnswer
  4. D
    Amazon Inspector

Answer

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts, workloads, and data. It uses machine learning and threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is continuous monitoring of AWS accounts for security threats and malicious activity by analyzing VPC Flow Logs, DNS logs, and CloudTrail events.
The requirement points to an intelligent threat detection service.
Understanding the core need helps narrow down the choices to security services designed for continuous log analysis and threat monitoring.
2
Evaluate the choices based on their core functionality.
AWS CloudTrail logs API activity; Amazon CloudWatch monitors system performance and application logs; Amazon Inspector scans for host vulnerabilities; Amazon GuardDuty performs intelligent threat detection using log analysis.
Differentiating these logging, monitoring, and security scanning services ensures the correct tool is selected for threat monitoring.

Key Concept

Continuous threat monitoring and intelligent log analysis on AWS
Estimated Time:45s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic