Examkin

Question

Difficulty: Very hardSecurity Logging, Monitoring, and Auditing

A company's security team is designing a multi-layered auditing and threat detection strategy for their application servers running on Amazon EC2. The team must satisfy three distinct operational security requirements:
1. Audit and record a history of all API calls, including the specific IAM identities, source IP addresses, and timestamps, to determine who modified resources.
2. Monitor active network traffic patterns to detect potential security threats, such as instances communicating with known command-and-control servers.
3. Track performance metrics of the EC2 instances, such as CPU utilization, and trigger automated alerts if resource usage exceeds defined limits.

Which combination of AWS services will successfully address these three requirements?

  1. A
    Amazon CloudWatch to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and AWS CloudTrail to monitor metrics and trigger threshold alerts.
  2. B
    AWS CloudTrail to audit API calls, Amazon Inspector to detect threat patterns and malicious communications, and Amazon CloudWatch to monitor metrics and trigger threshold alarms.
  3. AWS CloudTrail to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and Amazon CloudWatch to monitor metrics and trigger threshold alarms.Answer
  4. D
    AWS Artifact to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and AWS Support to monitor metrics and trigger threshold alarms under the infrastructure management tier of the Shared Responsibility Model.

Answer

AWS CloudTrail to audit API calls, Amazon GuardDuty to detect threat patterns and malicious communications, and Amazon CloudWatch to monitor metrics and trigger threshold alarms.
AWS CloudTrail is designed to audit and record API activity, user identities, and source IP addresses across the AWS account. Amazon GuardDuty uses threat intelligence and machine learning to actively monitor logs (like VPC Flow Logs and DNS logs) for security threats such as command-and-control communications. Amazon CloudWatch monitors performance metrics (like CPU utilization) and can trigger alarms and notifications when specific thresholds are breached.

Step-by-Step Solution

1
Identify the service responsible for auditing API activity, user identities, and timestamps across the AWS infrastructure.
AWS CloudTrail is determined to be the correct service for recording all account-level API activity.
CloudTrail provides continuous logging of management and data events for compliance and security auditing.
2
Determine the service needed for intelligent threat detection and identifying malicious network traffic like command-and-control communication.
Amazon GuardDuty is selected as the service that monitors network events and uses threat intelligence to detect malicious hosts.
GuardDuty analyzes VPC Flow Logs, DNS logs, and CloudTrail logs to identify active threats, whereas Amazon Inspector is only for static vulnerability scanning.
3
Find the service responsible for collecting resource metrics and triggering notifications based on performance thresholds.
Amazon CloudWatch is selected to monitor CPU utilization and send notifications through alarms.
CloudWatch tracks performance metrics and manages metric-based alerts, which is a customer-managed responsibility under the Shared Responsibility Model.

Key Concept

Selecting and distinguishing AWS security logging, threat monitoring, and operational alerting services.
Estimated Time:2m 0s
Rate this question

Topics

Security Logging, Monitoring, and Auditing

More questions from this topic