Examkin

Soru

Zorluk: ZorSecurity Logging, Monitoring, and Auditing

An enterprise client is designing a security monitoring architecture for their AWS environment. The client must satisfy two requirements:
1. Detect and alert in real-time when administrative actions, such as the deletion of an Amazon S3 bucket, are initiated by any user or role.
2. Continuously monitor the network activity of Amazon EC2 instances to identify active threat behaviors, such as outbound port scanning or communication with known malicious command-and-control servers.

Which combination of AWS services should the client implement to meet these requirements?

  1. A
    Amazon CloudWatch to log the administrative API activity for S3 bucket deletions, and Amazon GuardDuty to analyze network logs and detect threat behaviors from EC2 instances.
  2. B
    AWS CloudTrail to capture the administrative API activity for S3 bucket deletions, and Amazon Inspector to analyze network logs and detect threat behaviors from EC2 instances.
  3. AWS CloudTrail to capture the administrative API activity for S3 bucket deletions, and Amazon GuardDuty to analyze network logs and detect threat behaviors from EC2 instances.Cevap
  4. D
    AWS CloudTrail to capture the administrative API activity for S3 bucket deletions, and AWS security teams to manage and block OS-level outbound port scanning under the Shared Responsibility Model.

Cevap

The configuration using AWS CloudTrail to log S3 bucket deletions and Amazon GuardDuty to analyze network logs for EC2 threat behaviors is the correct choice.
The correct solution uses AWS CloudTrail to record administrative API calls, such as deleting S3 buckets, and Amazon GuardDuty to analyze network logs for malicious EC2 behavior. GuardDuty uses threat intelligence to detect active threats like port scanning or command-and-control communication, which satisfies the network monitoring requirement.

Adım Adım Çözüm

1
Determine which service is required for logging administrative API activity.
AWS CloudTrail is selected because it is designed to audit and record API calls made across AWS resources, including S3 bucket deletion.
This isolates the administrative auditing requirement from application performance monitoring.
2
Determine which service detects active network-level threat behaviors like port scanning.
Amazon GuardDuty is selected because it continuously monitors logs (such as VPC Flow Logs) using threat intelligence to detect malicious activity.
This distinguishes active threat detection from static vulnerability assessments.
3
Apply the AWS Shared Responsibility Model to identify customer operational duties.
The customer is responsible for configuring GuardDuty to protect their EC2 instances and OS-level traffic.
This confirms that managing threats within EC2 instances falls on the customer rather than AWS teams.

Anahtar Kavram

Auditing API calls with AWS CloudTrail, executing threat detection with Amazon GuardDuty, and understanding customer responsibilities under the Shared Responsibility Model.
Bu soruyu puanla

Konular

Security Logging, Monitoring, and Auditing

Bu konudan daha fazla soru