SCS-C02 Question 39
Select 2Your company has adopted a multi-account architecture using AWS Organizations. As part of the security strategy, you need to monitor and detect potential threats such as unauthorized access attempts, suspicious API activity, and malware across all accounts. Which AWS managed security services can you use to achieve this?
- A
Amazon GuardDuty
- B
AWS Security Hub
- C
Amazon Macie
- D
AWS Trusted Advisor
- E
Amazon Inspector
Show answer and explanation
Correct answers: A, B
Explanation
To detect threats such as unauthorized access, malicious activity, and suspicious API usage across AWS accounts, Amazon GuardDuty is the primary service designed for this purpose. AWS Security Hub complements GuardDuty by aggregating findings and providing a centralized view, making it easier to monitor threats in a multi-account environment. Other services like Macie, Trusted Advisor, and Inspector are valuable for specific use cases but are not focused on real-time threat detection.
- A. Correct.
Amazon GuardDuty is a managed threat detection service that helps detect unauthorized access attempts, anomalous API activity, and other threats by analyzing VPC Flow Logs, CloudTrail logs, and DNS logs. It is highly relevant for detecting threats across accounts.
- B. Correct.
AWS Security Hub aggregates and centralizes security findings from various AWS services, including GuardDuty, and provides a unified view for threat detection and compliance. It is an essential service for monitoring threats in a multi-account setup.
- C. Incorrect.
Amazon Macie is a security service focused on discovering and protecting sensitive data such as PII. While it is important for data protection, it is not specifically designed for detecting threats like unauthorized access or malicious activity.
- D. Incorrect.
AWS Trusted Advisor provides recommendations to optimize costs, improve performance, and enhance security. However, it does not actively monitor or detect threats like GuardDuty or Security Hub.
- E. Incorrect.
Amazon Inspector is used for vulnerability management and application security assessments. While it is valuable for identifying vulnerabilities, it is not a service designed for detecting active threats like GuardDuty.