SCS-C02 Question 30
Select 3Your company uses a centralized AWS account to manage security operations and monitor threats across multiple AWS accounts within an organization in AWS Organizations. You are tasked with detecting unusual API activity and potential unauthorized access attempts within the member accounts. Which combination of AWS services should you utilize to accomplish this task?
- A
Amazon GuardDuty for detecting anomalies and malicious activity
- B
AWS CloudTrail for tracking API calls and user activity
- C
AWS WAF for blocking unauthorized API requests
- D
Amazon Macie for identifying sensitive data exposure
- E
Amazon Detective for investigating and analyzing suspicious activity
Show answer and explanation
Correct answers: A, B, E
Explanation
To detect security threats and anomalies, Amazon GuardDuty can identify unusual API activity and potential unauthorized access. AWS CloudTrail logs provide a detailed record of API calls that can be analyzed for anomalies. Amazon Detective complements these services by enabling deeper investigation of suspicious activity. AWS WAF and Amazon Macie, while important for other security purposes, do not directly address the task of detecting anomalies or threats in API activity.
- A. Correct.
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.
- B. Correct.
AWS CloudTrail provides detailed logs of API calls and user activity, which are essential for identifying the source of anomalies.
- C. Incorrect.
AWS WAF is primarily used for protecting web applications from common web exploits and does not directly detect API activity anomalies or unauthorized access attempts.
- D. Incorrect.
Amazon Macie focuses on identifying and protecting sensitive data, but it is not a service designed to detect API activity anomalies or unauthorized access.
- E. Correct.
Amazon Detective helps analyze and investigate potential security issues by providing visualizations and insights into GuardDuty findings and CloudTrail logs.