Examkin

Question

Difficulty: EasySecurity Monitoring and Threat Detection

A retail company wants to continuously monitor its AWS accounts and workloads for malicious activity, including potential cryptocurrency mining and unauthorized API usage. The solution must require minimal operational overhead and provide automated threat intelligence. Which AWS service should a solutions architect recommend to meet these requirements?

  1. A
    AWS Shield
  2. B
    Network Access Control Lists (Network ACLs)
  3. Amazon GuardDutyAnswer
  4. D
    AWS WAF

Answer

Amazon GuardDuty is the correct AWS service to recommend because it provides intelligent threat detection and continuous monitoring for malicious activities like cryptocurrency mining and unauthorized API usage.
Amazon GuardDuty continuously monitors AWS accounts and workloads using data sources like VPC Flow Logs, CloudTrail management events, and DNS logs. It uses machine learning, anomaly detection, and threat intelligence to identify malicious activities like cryptocurrency mining or unauthorized access, satisfying the requirements with minimal operational overhead.

Step-by-Step Solution

1
Analyze the requirement for continuous, automated, account-wide monitoring for threats like cryptocurrency mining and unauthorized API activity.
Determine that the required service must perform threat detection and behavioral analysis, rather than simple network traffic filtering.
Understanding the monitoring scope helps eliminate basic firewalls and network security controls.
2
Evaluate AWS security services to find one designed for continuous intelligence monitoring and automated detection.
Identify Amazon GuardDuty as the dedicated managed service that uses machine learning and threat intelligence feeds to monitor AWS logs for anomalous and malicious behavior.
Matching the specific business need to the specialized AWS security service ensures compliance with the AWS Well-Architected framework.

Key Concept

Continuous security monitoring and threat detection using Amazon GuardDuty
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic