SCS-C02 Question 117
Select 3Your organization has configured an AWS environment to monitor security events. As a security administrator, you are tasked with identifying relevant data sources to detect potential unauthorized access to your AWS resources. Which of the following data sources should you prioritize for this purpose?
- A
AWS CloudTrail logs
- B
Amazon GuardDuty findings
- C
AWS Trusted Advisor service limits checks
- D
Amazon EC2 instance performance metrics
- E
VPC Flow Logs
Show answer and explanation
Correct answers: A, B, E
Explanation
To detect potential unauthorized access to AWS resources, you need to monitor data sources that provide insights into user activities, network traffic, and threat intelligence. AWS CloudTrail logs track API activity, which can reveal unauthorized actions. Amazon GuardDuty findings analyze multiple data streams to identify potential security threats. VPC Flow Logs provide network-level visibility that can help detect suspicious traffic patterns. Trusted Advisor checks and EC2 performance metrics, while valuable for other purposes, are not directly relevant for detecting security events.
- A. Correct.
AWS CloudTrail logs provide detailed audit trails of API calls and activities in your AWS environment, which are crucial for detecting unauthorized access and other security events.
- B. Correct.
Amazon GuardDuty findings are generated by analyzing event data such as CloudTrail logs, VPC Flow Logs, and DNS logs, and can highlight security threats such as unauthorized access attempts or compromised resources.
- C. Incorrect.
AWS Trusted Advisor service limits checks are not related to detecting unauthorized access or other security events. They focus on cost optimization, performance, fault tolerance, and service limits.
- D. Incorrect.
Amazon EC2 instance performance metrics, such as CPU utilization or disk read/write operations, are typically used for performance monitoring and do not directly indicate security events.
- E. Correct.
VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. They can help detect suspicious network activity, such as unauthorized access attempts or data exfiltration.