Examkin

Question

Difficulty: MediumSecurity Logging, Monitoring, and Auditing

A logistics company suspects that credentials for one of its administrative accounts have been compromised, leading to unauthorized resource creation in multiple AWS Regions. The security team wants to implement a service that continuously monitors their AWS accounts for malicious activity and anomalies, such as unauthorized API calls or unusual network traffic, without needing to write custom detection rules. Which AWS service should the company use to meet this requirement?

  1. Amazon GuardDutyAnswer
  2. B
    Amazon CloudWatch
  3. C
    Amazon Inspector
  4. D
    AWS Shield

Answer

Amazon GuardDuty is the correct AWS service to continuously monitor accounts for malicious activity and anomalies, such as unauthorized API calls, using intelligent threat detection.
Amazon GuardDuty is correct because it is a managed threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity, utilizing machine learning and anomaly detection to identify compromised credentials, unauthorized access, and malicious API patterns.

Step-by-Step Solution

1
Analyze the requirement for continuous, automated threat detection and account-level monitoring for compromised credentials and malicious activity.
Identify that the solution must analyze sources like CloudTrail events, VPC Flow Logs, and DNS logs to discover anomalies automatically.
This establishes the scope of security monitoring and logging needed for the scenario.
2
Evaluate the AWS security services to find the one that performs intelligent threat detection without requiring manual detection rule creation.
Select Amazon GuardDuty, as it uses machine learning and anomaly detection to identify threats like credential compromise across AWS accounts.
This distinguishes Amazon GuardDuty from performance monitoring tools, vulnerability scanners, or infrastructure DDoS protection.

Key Concept

AWS Security Logging, Monitoring, and Auditing using Amazon GuardDuty for threat detection.
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic