Exams / CLF-C02 / Security services / Question 3
CLF-C02 practice question: Security services (3 of 3)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company wants a service that continuously analyses AWS CloudTrail events, VPC flow logs and DNS logs to detect threats such as compromised credentials or cryptocurrency mining on its EC2 instances. It does not want to deploy or manage the log collection itself. Which service should it enable?
Choose one answer.
- AA. AWS Config
- BB. Amazon Macie
- CC. AWS WAF
- DD. Amazon GuardDuty
Show the answer and explanation
Answer: D
- A. Wrong: AWS Config evaluates resource configurations against rules. It does not analyse logs for signs of attack.
- B. Wrong: Macie discovers sensitive data in S3. It does not detect compromised credentials or cryptocurrency mining.
- C. Wrong: AWS WAF filters HTTP requests to web applications. It does not analyse CloudTrail, VPC flow logs or DNS logs.
- D. Right: Correct. GuardDuty is a threat detection service that analyses these foundational data sources automatically once it is enabled.
Explanation
Amazon GuardDuty uses threat intelligence and machine learning to analyse foundational data sources (CloudTrail management events, VPC flow logs and DNS logs) without any extra setup. It produces findings for threats such as compromised credentials, unusual API activity and cryptocurrency mining. Protection plans can extend it to other sources such as S3 data events and EKS audit logs.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.