Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A media streaming provider needs to implement a security monitoring strategy across its AWS environment. The provider wants to detect compromised IAM credentials and anomalous API requests made from unauthorized IP addresses. Additionally, they must track configurations and record resource changes over time for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Enable Amazon GuardDuty to continuously analyze AWS CloudTrail management events and detect credential misuse or unauthorized API patterns.Answer
  2. Implement AWS Config to record configurations of AWS resources and evaluate them against compliance rules.Answer
  3. C
    Configure stateless Network ACLs at the subnet level to automatically track and inspect returning IAM API traffic.
  4. D
    Deploy AWS Shield Standard on the front-end load balancers to block Layer 7 application exploits and malicious access key patterns.
  5. E
    Enable AWS Shield Advanced to analyze and filter out SQL injection attacks on the EC2 backend instances.

Answer

The correct options are enabling Amazon GuardDuty to analyze AWS CloudTrail management events and implementing AWS Config to record and track configurations of resources.
The correct architecture uses Amazon GuardDuty to monitor IAM credential security and API anomalies by digesting AWS CloudTrail logs, and AWS Config to track configuration history and ensure compliance baseline rules are met.

Step-by-Step Solution

1
Address credential compromise and anomalous API monitoring requirements.
Identify that Amazon GuardDuty analyses AWS CloudTrail management events to identify anomalous patterns of activity indicative of credential misuse or compromise.
GuardDuty has built-in threat intelligence and machine learning to identify credential abuse.
2
Address compliance and auditing requirements for configuration history.
Identify that AWS Config records the history of configurations and automatically evaluates changes against desired security baselines.
AWS Config is designed for auditing and compliance tracking of configuration history.

Key Concept

AWS Security Monitoring and Threat Detection using GuardDuty and AWS Config
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic