AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A SysOps administrator needs to proactively detect potential security threats within their AWS environment. They require a service that continuously monitors for malicious activity, unauthorized access, and unusual behavior across various data sources like VPC Flow Logs, DNS logs, and CloudTrail events, without requiring manual deployment or configuration of security agents. Which AWS service should be used?
- AAWS WAF
- BAmazon GuardDuty
- CAWS Security Hub
- DAmazon Detective
Show answer & explanationAnswer & explanation
Correct answer: B. Amazon GuardDuty
Amazon GuardDuty is a fully managed threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. It analyzes various AWS data sources, including VPC Flow Logs, DNS logs, and CloudTrail events, to identify potential threats without requiring agents or manual configuration.
Why the other options are wrong
- A. AWS WAF (Web Application Firewall) protects web applications from common web exploits, but it does not provide broad, account-level threat detection across VPC Flow Logs, DNS logs, and CloudTrail events.
- C. AWS Security Hub is a security posture management service that aggregates security findings from various AWS services and partners, but it doesn't perform the underlying threat detection itself.
- D. Amazon Detective helps investigate security findings identified by GuardDuty and other services, providing a visual analysis tool for root cause analysis, but it's not the primary threat detection service.
AWS GuardDuty Threat Detection
Amazon GuardDuty is a fully managed threat detection service that continuously monitors for malicious activity and unauthorized behavior across your AWS accounts and workloads by analyzing various AWS data sources.
- Continuously monitors for threats.
- Analyzes VPC Flow Logs, DNS logs, CloudTrail events.
- Agentless and fully managed service.
Memory trick: GuardDuty stands guard, always watching for danger in your AWS.