SCS-C02 Question 29
Select 2Your organization has deployed an e-commerce application on AWS that uses Amazon EC2 instances, an RDS database, and an Application Load Balancer (ALB). You have recently noticed unusual spikes in traffic and suspect a potential Distributed Denial of Service (DDoS) attack. Which combination of AWS services can help you detect and analyze the security threat in this scenario?
- A
Enable AWS Shield Advanced to monitor and mitigate DDoS attacks and analyze traffic patterns.
- B
Use AWS CloudTrail logs to track API calls and identify any unusual activity or spikes in resource usage.
- C
Leverage Amazon GuardDuty to analyze VPC flow logs and DNS queries for suspicious activity.
- D
Enable AWS Config to monitor configuration changes and detect unauthorized modifications to resources.
- E
Set up AWS Trusted Advisor to provide specific DDoS prevention recommendations.
Show answer and explanation
Correct answers: A, C
Explanation
Detecting and analyzing security threats such as DDoS attacks requires services that can monitor traffic patterns and detect anomalies. AWS Shield Advanced provides enhanced DDoS protection and traffic analysis, while Amazon GuardDuty uses machine learning to identify suspicious activities through VPC flow logs and other data sources. These services are most suitable for detecting and analyzing threats in this scenario.
- A. Correct.
AWS Shield Advanced is specifically designed to provide enhanced protection against DDoS attacks and offers detailed metrics and reports to analyze traffic patterns. This is highly relevant in detecting and mitigating DDoS threats.
- B. Incorrect.
AWS CloudTrail is useful for tracking API calls and detecting unusual activities. However, it is not specifically designed for detecting DDoS attacks or analyzing traffic patterns.
- C. Correct.
Amazon GuardDuty is ideal for analyzing VPC flow logs, DNS queries, and CloudTrail events to detect anomalies such as large-scale attacks or suspicious activity, which makes it relevant for this scenario.
- D. Incorrect.
AWS Config is used for monitoring configuration changes and compliance, but it is not directly relevant for detecting DDoS attacks or analyzing traffic anomalies.
- E. Incorrect.
AWS Trusted Advisor provides high-level best practices and recommendations but does not actively detect or analyze security threats such as DDoS attacks.