SCS-C02 Question 464
Select 4Your organization requires increased visibility and control over its AWS infrastructure to ensure compliance with security policies. The security team wants to monitor API activity, detect unusual patterns, and enforce specific rules to manage access to resources. Which combination of AWS services and features would best meet these requirements?
- A
AWS CloudTrail
- B
AWS Config
- C
AWS WAF (Web Application Firewall)
- D
Amazon GuardDuty
- E
AWS Service Control Policies (SCPs)
- F
AWS Shield Advanced
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To achieve visibility and control over AWS infrastructure, a combination of services is required. AWS CloudTrail provides API activity logs, enabling visibility into account actions. AWS Config tracks resource configurations and ensures compliance with security policies. Amazon GuardDuty adds threat detection capabilities to identify unusual patterns. Finally, AWS Service Control Policies (SCPs) enforce rules at the organization level, ensuring access to resources is properly controlled. Together, these services address the need for monitoring, compliance, threat detection, and access control.
- A. Correct.
AWS CloudTrail provides detailed logs of API activity across your AWS account, enabling visibility and auditability of actions taken.
- B. Correct.
AWS Config enables you to track configuration changes, assess compliance, and maintain infrastructure security by monitoring resource configurations.
- C. Incorrect.
AWS WAF is designed for protecting web applications from common web exploits and does not provide visibility into API activity or enforce access rules across AWS accounts.
- D. Correct.
Amazon GuardDuty is a threat detection service that uses machine learning to monitor AWS accounts for unusual and potentially malicious activity.
- E. Correct.
AWS Service Control Policies (SCPs) allow you to enforce governance across AWS accounts in your organization, controlling access and permissions at a high level.
- F. Incorrect.
AWS Shield Advanced is a DDoS protection service and is not relevant for monitoring API activity or enforcing access rules.