A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts. Which solution meets these requirements with the LEAST operational effort?

Question

Options

• ADesignate a GuardDuty administrator account and enable protections.
• BCentralize CloudWatch logs and use Inspector.
• CCentralize CloudTrail logs and query with Athena.
• DStream logs to Kinesis and process with Lambda.

• A
  71% (24)
• B
  18% (6)
• C
  3% (1)
• D
  9% (3)

Explanation

Explanation

Option A is correct because Amazon GuardDuty is a fully managed threat detection service that natively integrates with AWS Organizations, allowing a single administrator account to automatically enable and centrally monitor threat intelligence across hundreds of member accounts with minimal configuration - no infrastructure to build or maintain.

Option B is incorrect because centralizing CloudWatch logs and using Inspector requires significant manual setup; Inspector focuses on vulnerability assessments (EC2, containers, Lambda), not centralized log monitoring or threat detection across accounts.

Option C is incorrect because while centralizing CloudTrail logs with Athena queries is a valid security practice, it requires considerable operational effort - setting up S3 buckets, configuring trails per account, writing SQL queries, and manually triggering investigations rather than automatic detection.

Option D is incorrect because streaming logs to Kinesis and processing with Lambda is a custom-built solution requiring ongoing maintenance of code, infrastructure, and scaling configurations - the highest operational effort of all options.

Memory Tip

Think "Guard = Guard Duty, not Guard DIY." Whenever an exam question emphasizes automatic detection across multiple accounts with least operational effort, GuardDuty + AWS Organizations is almost always the answer - it's purpose-built for this exact multi-account, managed security monitoring scenario.

No community discussion yet for this question.