Examkin

Soru

Zorluk: ZorSecurity Logging, Monitoring, and Auditing

A security team needs to monitor an AWS environment for active threats and unauthorized behavior. They require a solution that automatically analyzes AWS CloudTrail events, VPC Flow Logs, and DNS logs to identify activities like an Amazon EC2 instance communicating with a known malicious command-and-control server. The solution must be agentless and operate at the account level. Which AWS service should the security team use to meet these requirements?

  1. A
    Amazon Inspector
  2. B
    Amazon CloudWatch
  3. Amazon GuardDutyCevap
  4. D
    AWS Systems Manager

Cevap

Amazon GuardDuty
Amazon GuardDuty is the correct service because it provides intelligent threat detection. It analyzes data from AWS CloudTrail, VPC Flow Logs, and DNS logs without requiring agents, allowing it to identify suspicious activities like communication with known malicious command-and-control servers.

Adım Adım Çözüm

1
Analyze the requirements of the scenario.
The scenario requires identifying active threats (like command-and-control traffic), analyzing logs (VPC Flow Logs, CloudTrail, DNS logs), and operating agentlessly at the AWS account level.
Understanding these parameters helps narrow down the correct security service that operates without host-based agents.
2
Differentiate between the candidate services.
Amazon GuardDuty is a threat detection service that matches the log analysis and agentless requirements. Amazon Inspector scans for vulnerabilities rather than active threats. Amazon CloudWatch collects logs and metrics but lacks built-in threat intelligence.
Distinguishing services based on their primary functions (vulnerability scanning vs. threat detection vs. log collection) points to the correct solution.
3
Select the correct service.
Amazon GuardDuty is selected as the correct answer.
It fulfills all criteria, including log source analysis and agentless detection.

Anahtar Kavram

AWS Threat Detection and Logging
Bu soruyu puanla

Konular

Security Logging, Monitoring, and Auditing

Bu konudan daha fazla soru