Examkin

Question

Difficulty: EasyThreat Detection and Vulnerability Management

A financial technology company wants to continuously monitor its AWS accounts for malicious activity and unauthorized behavior. The company needs a service that can analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to detect issues like compromised EC2 instances or unauthorized API calls. Which AWS service should the company use to meet this requirement?

  1. Amazon GuardDutyAnswer
  2. B
    Amazon Inspector
  3. C
    AWS CloudTrail
  4. D
    AWS Shield

Answer

Amazon GuardDuty
The correct service is Amazon GuardDuty because it is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes metadata from AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify threats like compromised credentials, communication with known malicious IPs, or anomalous behavior.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is to continuously monitor AWS accounts for malicious activity, unauthorized behavior, and potential threats by analyzing CloudTrail event logs, VPC Flow Logs, and DNS logs.
Understanding the source data (logs) and the desired outcome (threat detection) allows for the selection of the correct specialized security service.
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty is the specific service designed for intelligent threat detection via log analysis, whereas Amazon Inspector is for vulnerability scanning, AWS CloudTrail is for logging API calls, and AWS Shield is for DDoS protection.
Differentiating between vulnerability management, logging, protection, and threat detection determines the correct tool.

Key Concept

Intelligent threat detection using log analysis
Rate this question

Topics

Threat Detection and Vulnerability Management

More questions from this topic