SAP-C02 Question 250
Select 2A financial services company wants to enhance its security posture by detecting potential threats, aggregating findings from multiple AWS accounts, and mitigating DDoS attacks on their web applications. Which combination of AWS managed security services would best meet their requirements?
- A
Amazon GuardDuty, AWS Security Hub, and AWS Shield Advanced
- B
AWS WAF, Amazon GuardDuty, and AWS Config
- C
AWS Shield Advanced, AWS Security Hub, and AWS Firewall Manager
- D
Amazon GuardDuty, AWS WAF, and AWS Security Hub
- E
AWS Shield Standard, Amazon Macie, and AWS Config
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirements of detecting potential threats, aggregating security findings, and mitigating DDoS attacks, a combination of Amazon GuardDuty (threat detection), AWS Security Hub (findings aggregation), and a DDoS protection service like AWS Shield Advanced (for comprehensive DDoS protection) is necessary. AWS WAF can also be used to protect against application-layer attacks, making the combination of GuardDuty, WAF, and Security Hub another valid solution.
- A. Correct.
Correct. Amazon GuardDuty provides intelligent threat detection, AWS Security Hub aggregates findings from multiple accounts, and AWS Shield Advanced protects against DDoS attacks, fulfilling all the requirements.
- B. Incorrect.
Incorrect. While AWS WAF provides web application firewall capabilities, AWS Config focuses on compliance and resource configuration rather than threat detection or DDoS protection.
- C. Incorrect.
Incorrect. While AWS Shield Advanced provides DDoS protection and AWS Security Hub aggregates findings, AWS Firewall Manager is used for managing firewall rules at scale rather than threat detection.
- D. Correct.
Correct. Amazon GuardDuty provides threat detection, AWS WAF protects against application-layer attacks, and AWS Security Hub aggregates findings, making this a valid combination for enhancing security posture.
- E. Incorrect.
Incorrect. AWS Shield Standard provides basic DDoS protection, Amazon Macie focuses on sensitive data discovery, and AWS Config focuses on compliance rather than fulfilling all the requirements outlined in the scenario.