SCS-C02 Question 101
Select 2Your organization is running workloads on AWS that require continuous monitoring for unusual activities and adherence to security baselines. You have been tasked with implementing a solution to detect unauthorized access attempts, anomalous behavior, and deviations from baseline configurations. Which combination of services would best achieve these goals?
- A
Amazon GuardDuty for detecting anomalous activity and unauthorized access attempts
- B
AWS Config for monitoring configuration compliance against baselines
- C
AWS Shield Advanced for protecting against DDoS attacks
- D
Amazon CloudWatch for logging API requests to AWS resources
- E
AWS Systems Manager for automating operational tasks and patch management
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of detecting unauthorized access, anomalous behavior, and monitoring configuration compliance against baselines, the best combination of services is Amazon GuardDuty and AWS Config. GuardDuty specializes in threat detection, while Config ensures resource configurations adhere to compliance baselines. Other services like AWS Shield Advanced and Systems Manager address different use cases and do not align with the specific requirements given in the scenario.
- A. Correct.
Amazon GuardDuty is a threat detection service that monitors for unusual activities, unauthorized access attempts, and other security threats by analyzing AWS CloudTrail logs, VPC Flow Logs, and DNS logs.
- B. Correct.
AWS Config allows you to assess, audit, and evaluate the configurations of your AWS resources to ensure they comply with predefined baselines, making it useful for security posture monitoring.
- C. Incorrect.
AWS Shield Advanced is primarily designed for protecting against Distributed Denial of Service (DDoS) attacks. While useful for security, it is not relevant to monitoring metrics, baselines, or detecting unauthorized access.
- D. Incorrect.
Amazon CloudWatch is a monitoring and management service that can be used for collecting and tracking metrics and logs, but it does not specialize in detecting security threats or validating baseline compliance.
- E. Incorrect.
AWS Systems Manager is a tool for operational management, such as automation and patch management, but it does not provide capabilities for detecting anomalous activity or monitoring configuration baselines.