SCS-C02 Question 173
Select 2Your organization has recently detected unusual activity in an AWS account, such as sudden API call spikes and multiple failed login attempts. As a security engineer, you need to investigate and identify whether this activity is anomalous. Which combination of AWS services and features should you use to analyze and detect anomalies effectively?
- A
Use CloudTrail Insights to identify unusual API call patterns.
- B
Use CloudWatch Logs Insights to query and analyze logs for failed login attempts.
- C
Enable Security Hub Insights to directly block anomalous activity.
- D
Use CloudTrail to log all API activity and manually search for anomalies.
- E
Enable AWS Config rules to continuously monitor for compliance violations.
Show answer and explanation
Correct answers: A, B
Explanation
To effectively detect and analyze anomalous activity, you need to combine CloudTrail Insights, which detects unusual API activity patterns, with CloudWatch Logs Insights for querying and analyzing specific log data like failed login attempts. These tools provide targeted and efficient insights into unusual behavior, allowing you to investigate anomalies comprehensively.
- A. Correct.
CloudTrail Insights is specifically designed to detect unusual activity patterns, such as spikes in API calls or errors, making it a key service for anomaly detection.
- B. Correct.
CloudWatch Logs Insights allows you to query logs for specific patterns, such as failed login attempts, providing detailed analysis capabilities.
- C. Incorrect.
Security Hub Insights aggregates findings from multiple services but does not directly block anomalous activity. Its primary function is to provide visibility and recommendations for improving security posture.
- D. Incorrect.
While CloudTrail logs all API activity, manually searching for anomalies is less efficient and not specifically designed for anomaly detection. CloudTrail Insights is better suited for this purpose.
- E. Incorrect.
AWS Config is used for compliance monitoring and evaluating resource configurations, not for detecting activity anomalies or log analysis.