CLF-C02 Practice Question 64: Security Investigation
AWS Certified Cloud Practitioner (CLF-C02) · Test 7 · question 4 of 10
Amazon GuardDuty reports that an IAM role made unusual API calls from an unfamiliar IP address. An analyst now needs to find the root cause: what else the role did in the preceding weeks, which resources it touched, and whether that activity is unusual for this role. The analyst wants ready visualizations built from the account's logs, without writing queries or organizing log data by hand. Which service should the analyst use?
Show answer and explanation
Answer:
Amazon Detective helps you analyze, investigate and identify the root cause of security findings and suspicious activity. It automatically extracts events such as API calls, login attempts and network traffic from AWS CloudTrail and VPC Flow Logs, ingests GuardDuty findings, and builds a *behavior graph* with visualizations of up to a year of history. That graph answers questions like "Is this an unusual API call for this role?". You can move straight from a GuardDuty finding into Detective, and you don't have to organize data or write your own queries.
Option B, GuardDuty, is the service that *detected* the threat. It identifies suspicious activity but is not built for deep investigation of everything connected to a finding. Option C, CloudTrail Lake, does hold the raw activity, but using it means writing SQL queries against event data stores, which the analyst wants to avoid. Option D, Amazon Inspector, scans workloads for software vulnerabilities. It does not analyze what an IAM role has been doing.
Reference: What is Amazon Detective?