An AWS user wants to proactively detect when an instance or account might be compromised or if there are threats from attacks. Which AWS service should the user choose?

Question

Options

• AAmazon GuardDuty
• BAWS WAF
• CAWS Shield
• DAmazon Inspector

• A
  92% (23)
• B
  4% (1)
• D
  4% (1)

Explanation

Amazon GuardDuty (A) is correct because it is a threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to proactively identify potential compromises - exactly what the question describes.

Why the distractors are wrong:

• AWS WAF (B) is a web application firewall that filters malicious web traffic (e.g., SQL injection, XSS) - it blocks threats at the application layer rather than detecting account/instance compromises.
• AWS Shield (C) is a DDoS protection service specifically designed to defend against volumetric network attacks, not broader threat detection.
• Amazon Inspector (D) is a vulnerability assessment tool that scans EC2 instances and container images for software vulnerabilities and misconfigurations - it evaluates weaknesses rather than detecting active threats or compromises.

Memory Tip: Think of GuardDuty = Guard on Duty - like a security guard constantly watching your environment for suspicious activity 24/7. If the question mentions "detect," "monitor," "compromised," or "threat intelligence," GuardDuty is almost always the answer.

No community discussion yet for this question.