Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A ridesharing service processes real-time driver and passenger location data on AWS. The security department wants to establish automated threat detection that monitors their AWS accounts for anomalous behavior, such as API activity from unrecognized IP addresses, compromised credentials, or EC2 instances communicating with malicious IP addresses. The service must analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs. Which AWS service meets these needs?

  1. Amazon GuardDutyAnswer
  2. B
    Amazon Inspector
  3. C
    AWS CloudTrail
  4. D
    AWS Shield

Answer

Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze data sources such as AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify issues like compromised credentials or EC2 instances communicating with known malicious hosts.

Step-by-Step Solution

1
Identify the key security objective in the scenario.
The goal is active threat detection, credential monitoring, and detecting malicious command-and-control communication from EC2 instances.
Determining the primary security goal helps narrow down the appropriate AWS security services.
2
Analyze the log data sources requested for analysis.
The required sources are AWS CloudTrail events, VPC Flow Logs, and DNS logs.
Specific security tools ingest different log sources; only Amazon GuardDuty automatically parses these three specific sources for threat intelligence.
3
Eliminate inappropriate options.
Amazon Inspector is ruled out as it focuses on vulnerability scanning rather than live threat monitoring. AWS CloudTrail is ruled out as it logs actions but does not perform analysis. AWS Shield is ruled out as it handles external DDoS protection.
This confirms that only one service fulfills all threat detection and source analysis requirements.

Key Concept

Amazon GuardDuty is an intelligent threat detection service that analyzes multiple AWS log sources (CloudTrail, VPC Flow Logs, DNS logs) to identify malicious activity and unauthorized behavior.
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic