SCS-C02 Question 119
Select 3Your company has recently configured Amazon GuardDuty for threat detection across your AWS environment. During a routine security meeting, the team requests guidance on identifying relevant data that could indicate potential security events. Which of the following data sources should you enable or review to ensure GuardDuty can detect security threats effectively?
- A
VPC Flow Logs
- B
AWS CloudTrail event logs
- C
Amazon S3 lifecycle policies
- D
DNS query logs from Route 53
- E
IAM Access Analyzer findings
Show answer and explanation
Correct answers: A, B, D
Explanation
Amazon GuardDuty leverages data sources such as VPC Flow Logs, AWS CloudTrail event logs, and DNS query logs from Route 53 to detect potential security events. These data sources provide visibility into network traffic, account activity, and DNS queries, enabling GuardDuty to identify malicious activity, unauthorized access, and other security threats. Other options, such as Amazon S3 lifecycle policies and IAM Access Analyzer findings, do not contribute directly to GuardDuty's threat detection capabilities.
- A. Correct.
VPC Flow Logs provide network traffic data, which GuardDuty uses to detect patterns, anomalies, or potential malicious activity within your VPCs.
- B. Correct.
AWS CloudTrail event logs track API calls and account activity, providing critical information for identifying unauthorized access or suspicious actions in your AWS environment, which is utilized by GuardDuty.
- C. Incorrect.
Amazon S3 lifecycle policies manage the storage lifecycle of objects but are unrelated to security threat detection or GuardDuty's functionality.
- D. Correct.
DNS query logs from Route 53 provide insights into DNS patterns that could reveal domain-related threats, such as attempts to communicate with malicious domains. GuardDuty uses this data for threat detection.
- E. Incorrect.
IAM Access Analyzer findings are used to assess resource sharing and permissions but are not directly used by GuardDuty to detect security events.