Examkin

Question

Difficulty: HardSecurity Monitoring and Threat Detection

A company hosts its containerized microservices application on Amazon ECS using the AWS Fargate launch type. The company's security team requires a solution to detect runtime threats, such as execution of unauthorized binaries, malware, and credential theft, at the container level. Additionally, they must continuously audit all AWS resources in the environment against CIS benchmarks to ensure compliance. Which combination of AWS services should a solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. Enable Amazon GuardDuty and activate Amazon ECS Runtime Monitoring.Answer
  2. Enable AWS Security Hub and activate the CIS AWS Foundations Benchmark standard.Answer
  3. C
    Configure AWS WAF directly on the ECS Fargate task definitions to inspect container memory and block runtime exploits.
  4. D
    Deploy AWS Shield Advanced at the VPC subnet level to detect network-layer anomalies and host-level malware execution.
  5. E
    Create stateless Network ACL rules at the subnet level to analyze application-layer payloads and block container runtime anomalies.

Answer

The correct architecture consists of enabling Amazon GuardDuty with ECS Runtime Monitoring to detect container-level threats, and enabling AWS Security Hub with the CIS AWS Foundations Benchmark standard to continuously audit configurations for compliance.
The correct solution uses GuardDuty ECS Runtime Monitoring, which analyzes system calls from the underlying host to identify indicators of compromise inside Fargate tasks. Combined with AWS Security Hub running CIS benchmark compliance checks, the organization meets both real-time threat detection and configuration governance requirements.

Step-by-Step Solution

1
Analyze the container runtime security requirement
Identify that Amazon GuardDuty ECS Runtime Monitoring is designed to monitor and detect threats inside ECS containers on AWS Fargate by monitoring system calls.
This directly satisfies the requirement to detect unauthorized binaries, malware, and credential theft at the container level.
2
Analyze the compliance auditing requirement
Identify that AWS Security Hub provides automated configuration checks against security standards and industry frameworks like the CIS AWS Foundations Benchmark.
This directly satisfies the requirement to continuously audit all resources against CIS benchmarks.
3
Evaluate the incorrect services and scopes
Determine that AWS WAF, AWS Shield Advanced, and Network ACLs are network-level or DDoS-focused solutions that do not have the visibility into container runtimes or resource configurations required to meet either objective.
Eliminating these options confirms that GuardDuty and Security Hub are the appropriate choices.

Key Concept

Centralized threat detection and automated configuration auditing are key components of a secure cloud architecture, achieved through GuardDuty Runtime Monitoring and Security Hub compliance checks.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic