Examkin

Question

Difficulty: EasyThreat Detection and Vulnerability Management

A food delivery startup wants to continuously monitor its AWS accounts and workloads for malicious activity and unauthorized behavior, such as potential data exfiltration or unusual API calls. Which AWS service should the startup use to meet this requirement?

  1. A
    AWS CloudTrail
  2. B
    Amazon Inspector
  3. Amazon GuardDutyAnswer
  4. D
    AWS Artifact

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct service because it is an intelligent, managed threat detection service that continuously monitors AWS accounts, workloads, and S3 data for malicious activities, unauthorized access, and anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario, which is the need for continuous threat detection and monitoring of AWS accounts for malicious activity.
The solution must actively monitor and analyze account-level behavior for indicators of compromise or security anomalies.
This establishes that the correct service must have active threat detection capabilities rather than static vulnerability scanning or passive logging.
2
Compare the capabilities of the options to find the service that matches this threat monitoring requirement.
Amazon GuardDuty is identified as the service built to ingest data sources like CloudTrail events and VPC flow logs to identify suspicious activity.
Amazon GuardDuty uses machine learning and threat intelligence feeds to discover activities such as credential exfiltration and unauthorized API calls, which directly satisfies the startup's requirements.

Key Concept

Continuous threat detection with Amazon GuardDuty
Estimated Time:45s
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic