CLF-C02 Practice Question 24: Threat Detection
AWS Certified Cloud Practitioner (CLF-C02) · Test 3 · question 4 of 10
A security team wants a managed service that continuously analyzes the account's AWS CloudTrail management events, VPC flow logs, and DNS logs, and raises findings for threats such as compromised credentials or unauthorized cryptomining on EC2 instances. It does not want to install software to collect those logs. Which service meets this need?
Show answer and explanation
Answer:
Amazon GuardDuty is a threat detection service that continuously monitors and analyzes data sources in your AWS environment, using threat intelligence feeds and machine learning to identify suspicious and potentially malicious activity, including compromised AWS credentials and unauthorized cryptomining. When you enable it, GuardDuty automatically starts ingesting its foundational data sources (CloudTrail management events, VPC flow logs, and DNS logs) without you enabling anything else.
Option A, Amazon Inspector, finds software vulnerabilities and unintended network exposure in EC2 instances, container images, and Lambda functions; it assesses weaknesses rather than detecting active threats in logs. Option B, Amazon Macie, discovers sensitive data such as PII stored in Amazon S3. Option D, AWS Security Hub, aggregates and prioritizes findings from services such as GuardDuty and checks your environment against security standards; it consumes GuardDuty's findings rather than performing this log analysis itself.
Reference: What is Amazon GuardDuty?