A hospital's GuardDuty finding reports that an IAM user's access keys were used from an unusual country. The security team must find out what that identity did in the past month across 20 member accounts, which API calls it made, which resources it touched, and whether those calls connected it to other identities.
The analysts are not SQL specialists and must answer the question within one shift. They want a visual view of the relationships, and the data must be kept for at least 90 days so the team can look further back if needed.
Which solution should the team use?
Choose one answer.
AA. Query the CloudTrail logs in Amazon S3 with Amazon Athena, and write a SQL query for each account to list the calls made with the access key.
BB. Enable Amazon Detective through the organization administrator account, then open the user's profile from the finding to see its API activity, locations and related identities.
CC. Turn on GuardDuty S3 Protection and EKS Protection in all accounts, and read the new findings that appear for the same access key over the coming weeks.
DD. Search the VPC flow logs in CloudWatch Logs Insights for traffic from the unusual country, and treat the source addresses as the list of resources the user touched.
Show the answer and explanation
Answer: B
A. Wrong: Athena can answer the question, but the analysts must write and check SQL for each account, which they cannot do in one shift. The result is a table, not the visual view of relationships that the team wants.
B. Right: Correct. Detective builds behavior graphs from CloudTrail, VPC flow logs and GuardDuty data, and it shows an identity's activity and relationships without SQL. It keeps the data for up to a year, which covers the 90-day need. Learn more: What is Amazon Detective? (opens in a new tab)
C. Wrong: New findings show only what the service detects from now on, not what the identity did in the past month. The team needs history for the investigation, not new detections.
D. Wrong: Flow logs record network traffic, not API calls, so they cannot show what the identity did or which resources it changed. The source addresses also do not identify the principal behind the keys.
Explanation
Amazon Detective builds behavior graphs from logs that the accounts already produce, so analysts can pivot from a finding to an identity's activity and relationships. The retained history covers the 90-day need without writing SQL. Athena, new detections and flow logs each fail a stated requirement.
Want more on Scoping events and root cause analysis (Detective)? The 5 full-length practice sets have 8 more Scoping events and root cause analysis (Detective) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →