Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A financial technology firm wants to enhance its security posture on AWS. The firm needs to meet two specific requirements: first, they want to continuously monitor their AWS accounts, workloads, and data for malicious activity, such as unauthorized API calls or potential data exfiltration. Second, they need an automated way to scan container images stored in Amazon Elastic Container Registry (Amazon ECR) for software vulnerabilities before they are deployed to production.

Which two AWS services should the firm use to satisfy these security requirements? (Select two.)

  1. Amazon GuardDutyAnswer
  2. Amazon InspectorAnswer
  3. C
    AWS CloudTrail
  4. D
    Amazon CloudWatch
  5. E
    AWS Shield

Answer

The firm should use Amazon GuardDuty for continuous threat monitoring and Amazon Inspector to scan container images for vulnerabilities.
The correct options are the services designed for threat detection and vulnerability scanning. Continuous threat detection is provided by Amazon GuardDuty, which monitors accounts and workloads for malicious activity. Automated vulnerability scanning of container images in Amazon ECR is provided by Amazon Inspector.

Step-by-Step Solution

1
Identify the service needed for continuous monitoring of accounts, workloads, and data to detect malicious activity or unauthorized behavior.
Amazon GuardDuty uses machine learning and threat intelligence to detect malicious activity (such as resource hijacking, unauthorized access, or unusual API activity) across log sources like VPC Flow Logs, DNS logs, and CloudTrail events.
This directly fulfills the first requirement of threat detection.
2
Identify the service needed to scan container images stored in Amazon ECR for known software vulnerabilities before deployment.
Amazon Inspector automatically scans container images in ECR (as well as EC2 instances and Lambda functions) against vulnerability databases to identify security weaknesses.
This directly fulfills the second requirement of vulnerability management.

Key Concept

Continuous threat detection and automated software vulnerability scanning on AWS
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic