SCS-C02 Question 38
Select 2Your company has adopted a multi-account strategy on AWS. You want to ensure that all accounts are continuously monitored for potential security threats, such as unusual API activity or unauthorized access attempts. Which AWS managed security services can you use to detect such threats across all accounts in your organization?
- A
Amazon GuardDuty
- B
AWS Config
- C
AWS Security Hub
- D
AWS CloudTrail
- E
Amazon Inspector
Show answer and explanation
Correct answers: A, C
Explanation
To detect threats across multiple accounts, Amazon GuardDuty provides continuous real-time monitoring for malicious activity such as unauthorized access attempts, while AWS Security Hub aggregates and organizes findings from GuardDuty and other services to provide a centralized view of security alerts. These two services are essential for comprehensive threat detection and management. AWS Config, CloudTrail, and Amazon Inspector serve different purposes and do not specialize in threat detection.
- A. Correct.
Amazon GuardDuty is a fully managed threat detection service that continuously monitors for malicious or unauthorized behavior, such as unusual API activity and unauthorized access attempts. It is specifically designed for detecting and analyzing security threats.
- B. Incorrect.
AWS Config is a configuration management service that tracks resource configurations and compliance but does not detect security threats like unauthorized access or unusual behavior.
- C. Correct.
AWS Security Hub provides a centralized view to monitor and manage security alerts from multiple AWS services, including GuardDuty. It is key for aggregating and analyzing security findings across accounts.
- D. Incorrect.
AWS CloudTrail records API calls and events for auditing purposes but does not actively detect or analyze security threats. It can be used alongside GuardDuty for deeper investigation but isn't a threat detection service by itself.
- E. Incorrect.
Amazon Inspector is a vulnerability management service that identifies potential security risks in EC2 instances and container images. It does not monitor for real-time threats or unusual activity across accounts.