Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

A digital health platform hosts its microservices on Amazon ECS with AWS Fargate. The platform must comply with healthcare regulations that require continuous security auditing, real-time threat detection for container environments, and centralized tracking of security posture across multiple AWS accounts. The security team needs a solution that monitors API calls, detects runtime container anomalies, and compiles all findings into a unified security dashboard. Which combination of actions should a solutions architect recommend to satisfy these monitoring and detection requirements? (Select TWO.)

  1. Enable Amazon GuardDuty with ECS Runtime Monitoring to analyze VPC Flow Logs, DNS logs, CloudTrail events, and container runtime activity for threats.Answer
  2. Configure AWS Security Hub to centrally aggregate and prioritize compliance findings and security alerts from GuardDuty and other integrated AWS services.Answer
  3. C
    Configure AWS Shield Standard to monitor ECS container traffic for Layer 7 application exploits and automatically block common SQL injection vectors.
  4. D
    Configure stateless security groups at the Fargate task subnet level to inspect ingress payload data and automatically generate alerts for suspicious network activity.
  5. E
    Deploy AWS Shield Advanced at the VPC level to perform deep packet inspection of HTTP requests and block runtime anomalies inside the Fargate containers.

Answer

The platform should enable Amazon GuardDuty with ECS Runtime Monitoring to analyze log sources and container runtime activities, and configure AWS Security Hub to centrally aggregate compliance findings and security alerts.
The solution requires a service that detects threats within the container environment and a centralized security dashboard. Enabling Amazon GuardDuty with ECS Runtime Monitoring meets the threat detection requirement by analyzing VPC flow logs, DNS logs, CloudTrail, and Fargate runtime activities. Enabling AWS Security Hub meets the aggregation requirement by consolidating findings from GuardDuty and compliance standards into a single pane of glass.

Step-by-Step Solution

1
Select the correct threat detection service for the container environment.
Identify Amazon GuardDuty with ECS Runtime Monitoring.
GuardDuty monitors logs and Fargate runtime activity to detect container threat patterns.
2
Select the correct service to consolidate security findings and track compliance posture.
Identify AWS Security Hub.
AWS Security Hub consolidates security alerts and compliance statuses from multiple AWS services and accounts into a centralized dashboard.
3
Evaluate and eliminate incorrect options.
Eliminate options involving AWS Shield and stateless security groups at the subnet level.
AWS Shield is for DDoS protection (not Layer 7 exploits or container runtime anomalies), and Security Groups are stateful firewall rules applied to ENIs rather than subnets.

Key Concept

AWS Security Monitoring and Threat Detection architectures rely on GuardDuty for intelligent threat detection (including runtime container monitoring) and AWS Security Hub for centralized findings aggregation and compliance standards monitoring.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic