Examkin

Question

Difficulty: EasySecurity Monitoring and Threat Detection

A retail company wants to implement a solution to continuously monitor its AWS accounts and workloads for threat patterns, such as Amazon EC2 instances communicating with known malicious IP addresses or unexpected IAM activity. Which AWS service should the company use to meet this requirement?

  1. Amazon GuardDutyAnswer
  2. B
    AWS Shield
  3. C
    AWS WAF
  4. D
    Amazon VPC Security Groups

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses threat intelligence feeds and machine learning to identify signatures such as cryptocurrency mining, communication with known command-and-control servers, and abnormal API patterns.

Step-by-Step Solution

1
Analyze the requirements for continuous threat detection across AWS accounts and workloads, specifically for malicious IP communication and unexpected account activity.
Identify that the solution requires a service capable of processing multiple log sources (VPC Flow Logs, DNS logs, and CloudTrail logs) and performing anomaly detection.
Understanding the security monitoring scope helps select the appropriate service.
2
Evaluate the capabilities of the available AWS security services against the requirements.
Determine that Amazon GuardDuty is designed for threat detection by analyzing these logs, while firewalls and DDoS protection services act as enforcement mechanisms rather than logging/detection engines.
This isolates the correct threat detection service from traffic filtering services.

Key Concept

Continuous threat detection and security monitoring across workloads and account activity using Amazon GuardDuty.
Estimated Time:45s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic