A global company that deals with International finance is investing heavily in cryptocurrencies and wants to experiment with mining technologies using AWS. The company's security team has enabled…

Question

Options

• AIn the GuardDuty console, select the CryptoCurrency:EC2/BitcoinTool B'DNS finding and use the
• BCreate a custom AWS Lambda function to process newly detected GuardDuty alerts Process the
• CWhen creating a new Amazon EC2 Instance, provide the instance with a specific tag that
• DWhen GuardDuty produces a cryptocurrency finding, process the finding with a custom AWS

• A
  82% (31)
• B
  3% (1)
• C
  11% (4)
• D
  5% (2)

Explanation

Option A is correct because GuardDuty provides a native suppression rules feature that lets you filter specific finding types (like CryptoCurrency:EC2/BitcoinTool B!DNS) for authorized resources only - this means legitimate mining instances are silenced, while unauthorized/compromised instances performing the same activity still trigger alerts, directly minimizing false negatives.

Option B is wrong because a Lambda function that processes alerts after the fact doesn't prevent false negatives - it just reacts to findings already generated; it cannot distinguish authorized from unauthorized mining at the detection layer. Option C is wrong because simply tagging an EC2 instance has no native effect on GuardDuty's detection logic; tags alone don't configure suppression rules. Option D is wrong for the same core reason as B - post-processing findings with a custom solution is reactive and doesn't address the root requirement of minimizing false negatives at the GuardDuty level.

Memory tip: Think "suppress at the source, not after the fact." GuardDuty's built-in suppression rules let you silence noisy-but-legitimate findings for specific resources while keeping the detector armed for everything else - unlike Lambda workarounds, which process noise rather than eliminate it.

No community discussion yet for this question.