nerdexam
GIAC

GCIH · Question #753

Which Amazon AWS threat detection service monitors AWS accounts and workloads for malicious activity?

The correct answer is A. GuardDuty. Amazon GuardDuty is AWS's native managed threat detection service that continuously monitors accounts and workloads for malicious activity.

Cloud Incident Response & Threat Hunting

Question

Which Amazon AWS threat detection service monitors AWS accounts and workloads for malicious activity?

Options

  • AGuardDuty
  • BSecurity Center
  • CBeyondCorp
  • DSentinel

How the community answered

(61 responses)
  • A
    87% (53)
  • B
    3% (2)
  • C
    8% (5)
  • D
    2% (1)

Why each option

Amazon GuardDuty is AWS's native managed threat detection service that continuously monitors accounts and workloads for malicious activity.

AGuardDutyCorrect

Amazon GuardDuty analyzes AWS CloudTrail event logs, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds to identify threats such as unauthorized access, compromised EC2 instances, and reconnaissance activity. It is purpose-built for AWS environments and requires no additional infrastructure to deploy.

BSecurity Center

Security Center is a Microsoft Azure service (rebranded as Microsoft Defender for Cloud) and has no relationship to AWS.

CBeyondCorp

BeyondCorp is Google's zero-trust access framework and network security model, not an AWS threat detection service.

DSentinel

Microsoft Sentinel is a cloud-native SIEM and SOAR platform offered by Microsoft Azure, not Amazon AWS.

Concept tested: AWS GuardDuty threat detection service identification

Source: https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html

Topics

#AWS GuardDuty#cloud threat detection#AWS security#managed detection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice