SCS-C02 Question 44
Single answerYou are a Security Engineer working for a financial organization that has implemented AWS services to monitor and secure its environment. Your team has been tasked with detecting unusual login patterns across multiple AWS services, such as Amazon CloudTrail logs, Amazon GuardDuty findings, and VPC flow logs. What is the most effective way to correlate and analyze anomalies across these services in near real-time?
- A
Use Amazon CloudWatch Logs Insights to query the logs from each service separately and manually correlate anomalies.
- B
Deploy Amazon OpenSearch Service to ingest logs from all services and use its built-in anomaly detection capabilities to identify patterns.
- C
Implement an AWS Lambda function to fetch logs from each service and use a custom algorithm to detect and correlate anomalies.
- D
Leverage Amazon Security Lake to centralize security data and use Amazon Athena to query and correlate anomalies across services.
Show answer and explanation
Correct answer: D
Explanation
Amazon Security Lake is a fully managed service designed to centralize and analyze security data from various AWS services and third-party sources. By integrating with Amazon Athena, it enables you to efficiently query and correlate data to detect anomalies, making it the most suitable choice for this scenario. Other options either lack the capability to correlate data across services effectively or require extensive setup and maintenance.
- A. Incorrect.
Amazon CloudWatch Logs Insights is a powerful tool for querying logs, but it does not provide centralized correlation or anomaly detection across multiple services. Manual correlation would be inefficient and error-prone.
- B. Incorrect.
Amazon OpenSearch Service can perform log ingestion and anomaly detection, but it requires significant setup and management effort compared to purpose-built security solutions like Amazon Security Lake.
- C. Incorrect.
Using an AWS Lambda function to fetch logs and implement a custom algorithm would require extensive development and maintenance, making it a less efficient and scalable solution for this use case.
- D. Correct.
Amazon Security Lake is designed to centralize security data from multiple services, providing a streamlined way to correlate and query logs using Amazon Athena. This makes it an optimal solution for detecting anomalies across services in near real-time.