SCS-C02 Question 32
Select 3Your organization hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, you have noticed unusual spikes in traffic and suspect a potential Distributed Denial of Service (DDoS) attack. Which AWS services or features should you use to detect and analyze this security threat?
- A
Amazon GuardDuty
- B
AWS Shield Advanced
- C
Amazon Macie
- D
VPC Flow Logs
- E
AWS Config
Show answer and explanation
Correct answers: A, B, D
Explanation
To detect and analyze security threats like a DDoS attack, you should use services that provide threat detection, traffic pattern analysis, and DDoS mitigation capabilities. Amazon GuardDuty detects anomalous patterns and security threats, AWS Shield Advanced provides specialized DDoS detection and mitigation, and VPC Flow Logs offer traffic analysis that can help identify unusual spikes in traffic. Other services, like Amazon Macie and AWS Config, are not relevant for detecting or analyzing DDoS attacks in this scenario.
- A. Correct.
Amazon GuardDuty is a threat detection service that monitors for malicious or unauthorized behavior, such as DDoS attacks, and raises findings based on unusual traffic patterns.
- B. Correct.
AWS Shield Advanced provides enhanced DDoS detection and mitigation capabilities, which are useful for detecting and responding to potential DDoS attacks.
- C. Incorrect.
Amazon Macie is a data security service focused on discovering, classifying, and protecting sensitive data, and is not designed for detecting DDoS attacks or traffic anomalies.
- D. Correct.
VPC Flow Logs enable you to capture information about the IP traffic going to and from network interfaces in your VPC. Analyzing flow logs can help identify unusual traffic patterns indicative of a DDoS attack.
- E. Incorrect.
AWS Config is a configuration management service that tracks changes to AWS resources. While useful for compliance, it does not provide real-time traffic anomaly detection related to DDoS attacks.