A renewable energy company operates a web-based grid monitoring dashboard hosted on Amazon EC2 instances. The security team needs to implement a solution to monitor the environment for security threats, specifically targeting potential SSH brute-force attempts on the instances, while maintaining a comprehensive history of all management console activity and API calls for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)
- Enable Amazon GuardDuty to monitor VPC Flow Logs and analyze DNS query logs for anomalous behavior.Answer
- Enable AWS CloudTrail to log and retain account activity related to actions taken across the AWS infrastructure.Answer
- CDeploy AWS Shield Standard to inspect network traffic at the application layer for unauthorized access attempts.
- DConfigure stateless Network Access Control Lists (network ACLs) at the subnet level to dynamically track and block brute-force connections.
- EConfigure AWS Cost Explorer to track real-time API call metrics and trigger alerts when usage spikes.
Answer
The correct combination is to enable Amazon GuardDuty to monitor network and DNS activity for threats, and to enable AWS CloudTrail to capture and audit AWS API activities.
The correct approach is to combine threat detection and event auditing. The option to enable Amazon GuardDuty satisfies the requirement to identify brute-force attacks by analyzing network flows. The option to enable AWS CloudTrail fulfills the compliance requirement by logging all API operations and management activities.
Step-by-Step Solution
Key Concept
AWS security monitoring requires separating threat detection (using GuardDuty) from API and configuration audit logging (using CloudTrail).
Estimated Time:1m 30s