Examkin

Soru

Zorluk: KolayThreat Detection and Vulnerability Management

A financial technology company wants to continuously monitor its AWS accounts for malicious activity and unauthorized behavior. The company needs a service that can analyze AWS CloudTrail event logs, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to detect issues like compromised EC2 instances or unauthorized API calls. Which AWS service should the company use to meet this requirement?

  1. Amazon GuardDutyCevap
  2. B
    Amazon Inspector
  3. C
    AWS CloudTrail
  4. D
    AWS Shield

Cevap

Amazon GuardDuty
The correct service is Amazon GuardDuty because it is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity. It analyzes metadata from AWS CloudTrail event logs, VPC Flow Logs, and DNS logs to identify threats like compromised credentials, communication with known malicious IPs, or anomalous behavior.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario.
The requirement is to continuously monitor AWS accounts for malicious activity, unauthorized behavior, and potential threats by analyzing CloudTrail event logs, VPC Flow Logs, and DNS logs.
Understanding the source data (logs) and the desired outcome (threat detection) allows for the selection of the correct specialized security service.
2
Evaluate the capabilities of the available AWS security services.
Amazon GuardDuty is the specific service designed for intelligent threat detection via log analysis, whereas Amazon Inspector is for vulnerability scanning, AWS CloudTrail is for logging API calls, and AWS Shield is for DDoS protection.
Differentiating between vulnerability management, logging, protection, and threat detection determines the correct tool.

Anahtar Kavram

Intelligent threat detection using log analysis
Bu soruyu puanla

Konular

Threat Detection and Vulnerability Management

Bu konudan daha fazla soru