SCS-C02 Question 45
Select 3Your organization uses Amazon GuardDuty to monitor for security threats and anomalies in AWS accounts. To enhance the detection of unusual activity, you want to create visualizations to identify patterns and anomalies in GuardDuty findings. Which services or features would you use to create these visualizations?
- A
Amazon QuickSight
- B
AWS CloudTrail Insights
- C
Amazon Athena
- D
Amazon S3 Select
- E
Amazon CloudWatch Dashboards
Show answer and explanation
Correct answers: A, C, E
Explanation
To create visualizations to identify anomalies in Amazon GuardDuty findings, the findings can be exported to Amazon S3, queried using Amazon Athena, and visualized using Amazon QuickSight. Alternatively, custom metrics can be processed and visualized using Amazon CloudWatch Dashboards. AWS CloudTrail Insights and Amazon S3 Select, while useful for other purposes, are not suited for creating visualizations.
- A. Correct.
Amazon QuickSight is a business intelligence tool that can visualize data from various sources, including data queried using Amazon Athena. It's suitable for creating dashboards to visualize GuardDuty findings.
- B. Incorrect.
AWS CloudTrail Insights helps detect unusual operational activity but does not provide a visualization tool. It is used for anomaly detection in API usage patterns, not for creating visual dashboards.
- C. Correct.
Amazon Athena allows you to query data stored in Amazon S3, such as GuardDuty findings exported to S3. These queried results can then be used with tools like Amazon QuickSight for visualization.
- D. Incorrect.
Amazon S3 Select is used to query specific data from S3 objects but is not designed for creating visualizations. It is more suitable for filtering or extracting data at the object level.
- E. Correct.
Amazon CloudWatch Dashboards can be used to create visualizations of metrics and logs. While not specific to GuardDuty, it can display custom metrics derived from GuardDuty data processed by other AWS services.