SCS-C02 Question 106
Single answerA company has configured AWS CloudTrail to log all API activity and is using Amazon GuardDuty for threat detection. The security team notices that GuardDuty is not generating any findings, even though they suspect suspicious activity in their AWS account. What is the MOST likely reason for this issue?
- A
CloudTrail logging is disabled in the AWS account.
- B
GuardDuty is not properly integrated with AWS CloudTrail.
- C
The IAM role used by GuardDuty does not have sufficient permissions to access CloudTrail logs.
- D
GuardDuty is only configured to monitor S3 data events, not management events.
Show answer and explanation
Correct answer: A
Explanation
GuardDuty automatically integrates with AWS CloudTrail to monitor API activity and detect suspicious behavior. If no findings are generated, it is not due to a lack of integration but rather an issue with the activity level in the account, configuration of monitored event types, or legitimate absence of suspicious activity. The other options either misrepresent GuardDuty's capabilities or make incorrect assumptions about its dependencies.
- A. Correct.
If CloudTrail logging is disabled, GuardDuty cannot detect threats, as it relies on data from CloudTrail. However, this scenario assumes CloudTrail is enabled, so this is not the correct answer.
- B. Incorrect.
GuardDuty does not require manual integration with AWS CloudTrail. It automatically ingests data from CloudTrail when enabled. If there are no findings, the issue is likely related to the volume of activity or configuration rather than integration. This is the correct answer.
- C. Incorrect.
GuardDuty does not rely on an IAM role to access CloudTrail logs. The service operates independently and automatically ingests logs. This explanation does not apply to the scenario.
- D. Incorrect.
GuardDuty monitors various event types, including management events, S3 data events, and VPC flow logs. Limiting it to only S3 data events would not cause a complete lack of findings unless explicitly configured that way, which is not indicated in the scenario.