A security engineer needs to implement a solution to determine whether a company's Amazon EC2 instances are being used to mine cryptocurrency. The solution must provide notifications of cryptocurrency

Question

Options

• ACreate AWS Config custom rules by using Guard custom policy. Configure the AWS Config rules
• BEnable Amazon GuardDuty Create an Amazon EventBridge rule to send alerts to the SNS topic
• CEnable Amazon Inspector. Create an Amazon EventBridge rule to send alerts to the SNS topic
• DEnable VPC flow logs. Send the flow logs to an Amazon S3 bucket. Set up a query in Amazon

• A
  3% (1)
• B
  94% (34)
• C
  3% (1)

Explanation

Amazon GuardDuty is a managed threat detection service that uses machine learning and threat intelligence to identify malicious activity, including a specific finding type - CryptoCurrency:EC2/BitcoinTool.B - designed precisely to detect cryptocurrency mining on EC2 instances. Pairing GuardDuty with an EventBridge rule allows automatic routing of these findings to an SNS topic for notifications, making option B the complete, purpose-built solution.

Why the distractors fail:

• A (AWS Config + Guard custom policy): AWS Config evaluates configuration compliance (e.g., "is this S3 bucket public?"), not runtime threat behavior like active crypto mining.
• C (Amazon Inspector): Inspector performs vulnerability assessments and software exposure scanning - it does not detect behavioral threats like mining activity.
• D (VPC Flow Logs + S3 + Athena query): Flow logs capture network metadata but lack the behavioral intelligence to identify crypto mining patterns; this approach also requires significant manual setup with no native mining detection.

Memory tip: Think of GuardDuty as the AWS "security camera with AI" - it watches behavior in real time and knows what crypto mining looks like. Config and Inspector are more like auditors checking paperwork, and flow logs are raw footage with no built-in analysis.

No community discussion yet for this question.