Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

A logistics firm hosts its order-processing application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor the environment for network-layer threat activity, such as brute-force attacks or command-and-control (C2) communication, and receive alerts if any instances start communicating with known malicious IP addresses.

Which solution meets these requirements with the least operational overhead?

  1. A
    Modify the subnet's Network ACLs to act as a stateful firewall that monitors outbound connections, and use AWS Config to analyze these traffic patterns for threats.
  2. Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs for threat detection, and configure an Amazon EventBridge rule to send notifications through Amazon SNS when a finding is generated.Answer
  3. C
    Deploy AWS WAF at the subnet level to inspect all incoming TCP packets for network-layer anomalies, and use AWS Shield Standard to trigger alerts for malicious connections.
  4. D
    Configure security groups at the subnet level to generate logs of blocked connection attempts, and use AWS CloudTrail Insights to inspect active network streams.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs for threat detection, and configure an Amazon EventBridge rule to send notifications through Amazon SNS when a finding is generated.
The correct solution uses Amazon GuardDuty, which natively integrates and analyzes VPC Flow Logs, DNS query logs, and CloudTrail events. It detects threat patterns such as command-and-control (C2) communication and brute-force attempts without requiring any software agents. By routing GuardDuty findings through Amazon EventBridge to an Amazon SNS topic, the security team receives automated, real-time alerts with minimal operational effort.

Step-by-Step Solution

1
Enable Amazon GuardDuty in the AWS account.
GuardDuty automatically begins consuming metadata streams from VPC Flow Logs, DNS logs, and AWS CloudTrail events without requiring additional agent installation or infrastructure setup.
This establishes the core intelligent threat detection engine, which uses threat intelligence feeds and machine learning to identify brute-force attacks and C2 activity.
2
Configure an Amazon EventBridge rule with a pattern matching GuardDuty finding events.
EventBridge detects when GuardDuty publishes a threat finding and triggers the configured target.
This allows for real-time orchestration of alerting pathways based on security findings.
3
Target the EventBridge rule to an Amazon Simple Notification Service (Amazon SNS) topic with subscriber endpoints (such as email or Slack webhook).
Notifications are automatically dispatched to the security team whenever a matching threat is detected.
This satisfies the requirement for proactive alerting with minimal operational overhead.

Key Concept

Continuous security monitoring and threat detection at the network layer using managed AWS services.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic