SCS-C02 Question 41
Select 2Your company uses AWS CloudTrail to capture API activity logs across multiple AWS accounts. Additionally, Amazon GuardDuty is enabled to monitor anomalous and potentially malicious activity. Recently, an incident occurred where an IAM user performed multiple failed login attempts followed by suspicious API calls. To investigate and correlate this anomaly, which approach should you take?
- A
Use Amazon Detective to analyze and visualize the CloudTrail logs for correlation between failed logins and subsequent API calls.
- B
Export CloudTrail logs to Amazon S3 and use Amazon Athena to query for patterns of failed login attempts followed by API calls.
- C
Enable CloudWatch Logs Insights to directly correlate failed IAM login attempts with GuardDuty findings.
- D
Set up an AWS Config rule to detect patterns of failed logins and automatically correlate them with suspicious API calls.
- E
Use Amazon QuickSight to create a dashboard that connects CloudTrail logs and GuardDuty findings for manual investigation.
Show answer and explanation
Correct answers: A, B
Explanation
To effectively analyze and correlate anomalies across AWS services like CloudTrail and GuardDuty, tools like Amazon Detective and Amazon Athena are ideal. Amazon Detective is built for visualizing and investigating security findings, while Athena allows querying CloudTrail logs directly for patterns. CloudWatch Logs Insights and AWS Config are not designed for this specific correlation use case, and QuickSight is better suited for data visualization rather than log analysis.
- A. Correct.
Amazon Detective is specifically designed to analyze and visualize data from sources like CloudTrail and GuardDuty. It provides insights into relationships and patterns, making it an effective tool for this use case.
- B. Correct.
Exporting CloudTrail logs to S3 and using Athena allows you to run SQL-like queries to identify patterns, such as failed login attempts followed by API calls. This is a valid approach to correlate the data.
- C. Incorrect.
While CloudWatch Logs Insights can query log data, it does not natively correlate IAM login failures with GuardDuty findings. Additional processing or tools would be required for this functionality.
- D. Incorrect.
AWS Config is a service designed for resource compliance and configuration tracking, not for log analysis or anomaly correlation.
- E. Incorrect.
Amazon QuickSight is a visualization tool, but it is not optimized for log analysis or real-time anomaly detection. It would require pre-processed data from other tools.