Examkin

Soru

Zorluk: OrtaThreat Detection and Vulnerability Management

A smart home device manufacturer hosts its telemetry processing application on a fleet of Amazon EC2 instances. The security team wants to continuously monitor the AWS environment for potential security threats, such as EC2 instances communicating with known malicious IP addresses or unexpected API calls from unauthorized locations. Which AWS service should the manufacturer use to detect these active threats?

  1. A
    AWS CloudTrail
  2. B
    Amazon Inspector
  3. Amazon GuardDutyCevap
  4. D
    Amazon CloudWatch

Cevap

Amazon GuardDuty
The correct service is Amazon GuardDuty. It is an intelligent threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as an EC2 instance communicating with a command-and-control server or anomalous API calls from unauthorized locations.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario requires a service that continuously monitors the AWS environment for active threats, specifically targeting malicious IP communication and unauthorized API calls.
Identifying the target behavior (active threat detection) helps narrow down the service choices.
2
Compare the capabilities of the security services
Amazon GuardDuty provides threat detection by analyzing logs (such as VPC Flow Logs and CloudTrail logs), whereas Amazon Inspector focuses on scanning for software vulnerabilities. AWS CloudTrail and Amazon CloudWatch provide logging and monitoring but lack native intelligent threat intelligence analysis.
This distinguishes between vulnerability scanning (static assessment) and threat detection (runtime analysis).

Anahtar Kavram

Amazon GuardDuty provides intelligent, continuous threat detection and monitoring for AWS workloads, while Amazon Inspector focuses on vulnerability assessment and patch scanning.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Threat Detection and Vulnerability Management

Bu konudan daha fazla soru