Exams / SAA-C03 / Threat detection and data discovery / Question 1
SAA-C03 practice question: Threat detection and data discovery (1 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A start-up runs its platform on Amazon EC2 instances in one AWS account. The security lead wants to be told automatically if an instance starts talking to servers known for cryptocurrency mining, or if the account's AWS credentials are used in an unusual way, such as from an unexpected location. The team is small and does not want to install agents or build its own log analysis. Which solution meets these requirements?
Choose one answer.
- AA. Turn on Amazon Inspector so that it scans the EC2 instances and container images for software vulnerabilities and unintended network exposure.
- BB. Turn on Amazon GuardDuty, and send its findings to the team through an Amazon EventBridge rule and an Amazon SNS topic.
- CC. Turn on Amazon Detective so that it builds a graph of account activity that the team can explore to investigate suspicious behaviour.
- DD. Turn on AWS Config with managed rules that flag EC2 instances and IAM resources whose configuration breaks the company's standards.
Show the answer and explanation
Answer: B
- A. Wrong: Amazon Inspector finds software vulnerabilities and network exposure in workloads. It reports on weaknesses that could be exploited, not on live suspicious behaviour such as mining traffic or odd credential use. GuardDuty is the threat detection service. Learn more: What is Amazon Inspector? (opens in a new tab)
- B. Right: Correct. GuardDuty analyses CloudTrail management events, VPC flow logs and DNS logs on its own, with no agents for these sources. It produces findings for cryptomining activity and compromised credentials, and EventBridge can route those findings to an SNS topic for alerts. Learn more: What is Amazon GuardDuty? (opens in a new tab)
- C. Wrong: Detective helps analysts investigate the cause and scope of security findings after they are raised. It is not the service that raises alerts in the first place. GuardDuty produces the findings that Detective then helps investigate. Learn more: What is Amazon Detective? (opens in a new tab)
- D. Wrong: AWS Config records resource configurations and checks them against rules. It can spot an insecure setting, but it does not watch network traffic or credential use for signs of an attack. GuardDuty covers that. Learn more: What is AWS Config? (opens in a new tab)
Explanation
Amazon GuardDuty is a managed threat detection service. Once turned on, it analyses CloudTrail management events, VPC flow logs and DNS logs without agents, and raises findings for threats such as cryptomining and compromised credentials. Inspector finds vulnerabilities, Detective investigates findings, and Config checks configuration.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.