Examkin

Soru

Zorluk: OrtaThreat Detection and Vulnerability Management

An automotive telemetry platform processes data from millions of connected vehicles and stores it in AWS. The security operations team needs to continuously monitor the AWS accounts and containerized workloads for threats such as cryptocurrency mining, credential exfiltration, and communication with malicious IP addresses. Which AWS service should the platform team use to perform this intelligent threat detection?

  1. A
    Amazon Inspector
  2. Amazon GuardDutyCevap
  3. C
    AWS CloudTrail
  4. D
    AWS Shield

Cevap

Amazon GuardDuty is the correct AWS service to perform continuous, intelligent threat detection by monitoring activities such as potential cryptocurrency mining, compromised credentials, and unauthorized communications.
Amazon GuardDuty is a continuous security monitoring service that analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS query logs. It uses threat intelligence feeds and machine learning to identify anomalous and malicious activities within the AWS environment, such as communication with command-and-control servers or cryptocurrency mining.

Adım Adım Çözüm

1
Analyze the operational requirements of the security team.
The platform requires intelligent, continuous threat detection targeting behaviors like cryptocurrency mining, credential exfiltration, and malicious IP communications.
Distinguishing between vulnerability scanning (proactive software analysis) and active threat detection (reactive/behavioral log analysis) is critical to selecting the correct AWS service.
2
Map the requirements to the correct AWS security service.
Amazon GuardDuty continuously analyzes data sources including CloudTrail events, VPC Flow Logs, and DNS logs to identify malicious activities and anomalies. The other services listed perform vulnerability assessment (Amazon Inspector), auditing (AWS CloudTrail), or DDoS mitigation (AWS Shield).
Aligning AWS service capabilities with the scenario's functional demands identifies the correct solution.

Anahtar Kavram

Continuous Threat Detection and Anomaly Monitoring
Bu soruyu puanla

Konular

Threat Detection and Vulnerability Management

Bu konudan daha fazla soru