SAP-C02 Question 252
Select 4A company hosts a web application on AWS that is frequently targeted by malicious actors attempting to exploit vulnerabilities and perform DDoS attacks. The company wants to enhance its security posture by automatically detecting threats, blocking malicious web requests, and centralizing security findings. Which combination of AWS managed security services should the company use to achieve its goals?
- A
AWS WAF to filter malicious web traffic and block specific attack patterns
- B
Amazon GuardDuty to detect threats by analyzing VPC Flow Logs, DNS logs, and CloudTrail events
- C
AWS Shield Advanced to protect against sophisticated DDoS attacks
- D
AWS Config to enforce compliance and track infrastructure changes
- E
AWS Security Hub to aggregate and prioritize security findings across multiple accounts
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To effectively enhance security against malicious activity and DDoS attacks, the company should use AWS WAF to filter and block malicious web traffic, Amazon GuardDuty to detect threats by analyzing logs, AWS Shield Advanced for DDoS protection, and AWS Security Hub to centralize and prioritize security findings. AWS Config, while useful for compliance, does not directly contribute to threat detection or attack mitigation in this scenario.
- A. Correct.
AWS WAF is used to filter and block malicious web traffic by creating rules to stop specific attack patterns, such as SQL injection or cross-site scripting.
- B. Correct.
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior in AWS environments by analyzing various logs.
- C. Correct.
AWS Shield Advanced provides protection against DDoS attacks, including advanced reporting and support for mitigating sophisticated DDoS scenarios.
- D. Incorrect.
AWS Config is primarily used for compliance and change management, which does not directly address threat detection or malicious request blocking.
- E. Correct.
AWS Security Hub aggregates security findings from various AWS services, such as GuardDuty and AWS WAF, and provides a centralized view for prioritizing and managing security issues.