SCS-C02 Question 104
Select 2Your company has deployed a set of EC2 instances running a critical application in a VPC. The Security team wants to ensure that the environment is continuously monitored for any unusual or suspicious activity, such as unauthorized access attempts, port scans, or attempts to disable encryption on data at rest. Which AWS services should you configure to achieve this monitoring objective?
- A
Amazon GuardDuty
- B
AWS CloudTrail
- C
Amazon Macie
- D
AWS Systems Manager
- E
AWS Config
Show answer and explanation
Correct answers: A, B
Explanation
To monitor for unusual or suspicious activities such as unauthorized access attempts or port scans, Amazon GuardDuty is the primary AWS service designed for threat detection. AWS CloudTrail complements this by providing detailed logging of API calls and resource access, allowing for a deeper investigation of potential security incidents. While services like Macie, Systems Manager, and Config are valuable in other security and management contexts, they do not address the specific requirements of continuous monitoring for suspicious activity in this scenario.
- A. Correct.
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, such as port scans or brute-force attacks, making it an appropriate tool for this scenario.
- B. Correct.
AWS CloudTrail records API calls and user activities, providing valuable information about unauthorized access attempts or changes to resources in the environment. It complements GuardDuty by offering detailed logs for analysis.
- C. Incorrect.
Amazon Macie focuses on data classification and protection, identifying sensitive data such as personally identifiable information (PII). It is not designed to detect suspicious activities like port scans or unauthorized access attempts.
- D. Incorrect.
AWS Systems Manager provides operational insights and management capabilities for AWS resources but is not a threat detection tool for monitoring suspicious activities or unauthorized behavior.
- E. Incorrect.
AWS Config tracks the resource configuration state for compliance purposes but does not detect or respond to security threats, such as unauthorized access attempts or port scans.