Examkin

Question

Difficulty: MediumThreat Detection and Vulnerability Management

A smart home device manufacturer hosts its telemetry processing application on a fleet of Amazon EC2 instances. The security team wants to continuously monitor the AWS environment for potential security threats, such as EC2 instances communicating with known malicious IP addresses or unexpected API calls from unauthorized locations. Which AWS service should the manufacturer use to detect these active threats?

  1. A
    AWS CloudTrail
  2. B
    Amazon Inspector
  3. Amazon GuardDutyAnswer
  4. D
    Amazon CloudWatch

Answer

Amazon GuardDuty
The correct service is Amazon GuardDuty. It is an intelligent threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as an EC2 instance communicating with a command-and-control server or anomalous API calls from unauthorized locations.

Step-by-Step Solution

1
Analyze the requirements in the scenario
The scenario requires a service that continuously monitors the AWS environment for active threats, specifically targeting malicious IP communication and unauthorized API calls.
Identifying the target behavior (active threat detection) helps narrow down the service choices.
2
Compare the capabilities of the security services
Amazon GuardDuty provides threat detection by analyzing logs (such as VPC Flow Logs and CloudTrail logs), whereas Amazon Inspector focuses on scanning for software vulnerabilities. AWS CloudTrail and Amazon CloudWatch provide logging and monitoring but lack native intelligent threat intelligence analysis.
This distinguishes between vulnerability scanning (static assessment) and threat detection (runtime analysis).

Key Concept

Amazon GuardDuty provides intelligent, continuous threat detection and monitoring for AWS workloads, while Amazon Inspector focuses on vulnerability assessment and patch scanning.
Estimated Time:1m 0s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic