Examkin

Question

Difficulty: HardSecurity Logging, Monitoring, and Auditing

A security team needs to monitor an AWS environment for active threats and unauthorized behavior. They require a solution that automatically analyzes AWS CloudTrail events, VPC Flow Logs, and DNS logs to identify activities like an Amazon EC2 instance communicating with a known malicious command-and-control server. The solution must be agentless and operate at the account level. Which AWS service should the security team use to meet these requirements?

  1. A
    Amazon Inspector
  2. B
    Amazon CloudWatch
  3. Amazon GuardDutyAnswer
  4. D
    AWS Systems Manager

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection. It analyzes data from AWS CloudTrail, VPC Flow Logs, and DNS logs without requiring agents, allowing it to identify suspicious activities like communication with known malicious command-and-control servers.

Step-by-Step Solution

1
Analyze the requirements of the scenario.
The scenario requires identifying active threats (like command-and-control traffic), analyzing logs (VPC Flow Logs, CloudTrail, DNS logs), and operating agentlessly at the AWS account level.
Understanding these parameters helps narrow down the correct security service that operates without host-based agents.
2
Differentiate between the candidate services.
Amazon GuardDuty is a threat detection service that matches the log analysis and agentless requirements. Amazon Inspector scans for vulnerabilities rather than active threats. Amazon CloudWatch collects logs and metrics but lacks built-in threat intelligence.
Distinguishing services based on their primary functions (vulnerability scanning vs. threat detection vs. log collection) points to the correct solution.
3
Select the correct service.
Amazon GuardDuty is selected as the correct answer.
It fulfills all criteria, including log source analysis and agentless detection.

Key Concept

AWS Threat Detection and Logging
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic