AWS Certified SysOps Administrator – AssociateSecurity and ComplianceMedium
A security engineer needs to implement a solution to automatically detect and alert on unusual and potentially unauthorized activities within an AWS account, such as port scanning, crypto-currency mining, or unusual API calls from a compromised instance. The solution should be intelligent and learn from normal behavior. Which AWS service is BEST suited for this requirement?
- AAmazon GuardDuty
- BAWS CloudTrail
- CAmazon Inspector
- DAWS Security Hub
Show answer & explanationAnswer & explanation
Correct answer: A. Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats like those described.
Why the other options are wrong
- B. CloudTrail records API calls and related events, which is essential for auditing, but it does not inherently perform threat detection or anomaly analysis.
- C. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS, focusing on vulnerabilities and deviations from best practices, not real-time threat detection.
- D. Security Hub provides a comprehensive view of your security alerts and compliance status across AWS accounts, aggregating findings from other services like GuardDuty, but it's not a threat detection engine itself.
Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence.
- Monitors AWS accounts and workloads.
- Detects threats like crypto-currency mining, port scanning.
- Uses machine learning for anomaly detection.
- Integrates with other AWS security services.
Memory trick: GuardDuty: The Smart Security Guard.