SAA-C03 Practice Question 52: GuardDuty Threat Detection
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 6 · question 2 of 10
A security team wants to be told when an EC2 instance starts communicating with a known cryptomining pool, or when API calls are made with an IAM role's credentials from an IP address that has never been seen before. They do not want to install agents on the instances, build a log pipeline, or write detection logic themselves.
Which AWS service should they enable?
Show answer and explanation
Answer:
GuardDuty is the managed threat detection service. Enabling it in an account starts continuous ingestion of CloudTrail management events, VPC flow logs and DNS logs with no agent to install and no pipeline to build. It compares that activity against threat intelligence feeds and machine learning models, and both scenarios in the question map directly to finding types it ships with: unauthorized cryptomining on EC2, and credentials used from anomalous locations. Findings are generated automatically and can be routed to EventBridge for alerting.
Option A scans workloads for software vulnerabilities and unintended network exposure. Inspector tells you that a package has a known CVE; it does not watch live network or API behaviour and would never raise either of these events.
Option B is a data classification service. Macie discovers sensitive data such as personally identifiable information in S3 buckets. It has nothing to say about instance network traffic or credential use.
Option D evaluates whether resource *configuration* matches desired rules: an unencrypted volume, a security group open to the world. Config assesses static configuration state, so a correctly configured instance that has been compromised at runtime is invisible to it, and unusual API source addresses are not a configuration property at all.
Reference: What is Amazon GuardDuty?