AWS Certified Security – SpecialtyDomain 2: Logging and MonitoringEasy
A security engineer needs to establish a robust monitoring solution to detect unusual API call patterns, unauthorized access attempts, and potential insider threats across multiple AWS accounts within an AWS Organization. The solution must be cost-effective and provide near real-time threat detection capabilities without requiring extensive manual configuration. Which AWS service is best suited for this requirement?
- AAWS Config
- BAmazon GuardDuty
- CAmazon CloudWatch Logs
- DAWS Security Hub
Show answer & explanationAnswer & explanation
Correct answer: B. Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It provides near real-time detection of unusual API calls, potential insider threats, and other security issues across multiple accounts.
Why the other options are wrong
- A. AWS Config focuses on auditing and evaluating the configurations of your AWS resources, not real-time threat detection based on API call patterns.
- C. Amazon CloudWatch Logs is a logging service that can store and monitor logs, but it requires significant manual configuration of alarms and filters to detect threat patterns, which is not cost-effective or near real-time without additional services.
- D. AWS Security Hub provides a comprehensive view of your security state and helps you check your compliance with the security industry standards and best practices, but it relies on findings from other services like GuardDuty for threat detection.
Amazon GuardDuty
A threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It uses machine learning, anomaly detection, and integrated threat intelligence.
- Monitors AWS CloudTrail, VPC Flow Logs, and DNS logs.
- Provides near real-time, continuous threat detection.
- Managed service, requires minimal configuration.
Memory trick: GuardDuty stands guard, detecting danger.