Threat detection and data discovery: SAA-C03 study notes and practice questions
What to know about Threat detection and data discovery for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 2 free questions to test it. Part of the SAA-C03 study guide.
These questions are mostly about telling similar-sounding security services apart. Each one answers a different question.
Service
Answers the question
How
Amazon GuardDuty
“Is something malicious happening in my accounts?”
Analyzes CloudTrail events, VPC Flow Logs and DNS logs (plus optional S3, EKS, RDS, Lambda and runtime monitoring) with no agents to install for the foundational sources; raises findings such as cryptomining or credential misuse
Amazon Macie
“Where is the sensitive data (PII, credentials) in S3?”
Scans and samples S3 objects with managed and custom data identifiers; also flags buckets that are public or shared
Amazon Inspector
“Which workloads have known vulnerabilities?”
Scans EC2 instances, container images in ECR and Lambda functions for CVEs and network exposure, continuously
AWS Security Hub
“What is my overall security posture across accounts?”
Collects findings from GuardDuty, Inspector, Macie and others, and runs best-practice checks
Amazon Detective
“What exactly happened during this incident?”
Builds a graph from logs so you can investigate a GuardDuty finding
AWS Config
“Is this resource configured the way our rules say?”
Records configuration changes and evaluates rules
AWS CloudTrail
“Who called which API, and when?”
Logs API activity
Key facts
All of these work across an organization with a delegated administrator account, and can be turned on automatically for new accounts.
Findings flow to Amazon EventBridge, so automated responses (isolate an instance, notify a team, revoke a key) are an EventBridge rule plus a target such as Lambda or Systems Manager Automation.
GuardDuty doesn’t block anything by itself. It detects; you respond.
How to choose
“Detect compromised instances or unusual API calls with minimal setup”: GuardDuty.
“Find out which buckets hold credit card numbers”: Macie.
“Patch priority for software vulnerabilities on EC2 and container images”: Inspector.
“One dashboard for findings from many accounts and services”: Security Hub.
“Respond automatically to a finding”: EventBridge rule on the finding, triggering Lambda or Systems Manager.
Common traps
Using Macie for threat detection or GuardDuty for finding PII. They sound alike in a hurry; read what is being found.
Building custom log analysis in Athena or OpenSearch when GuardDuty already does it. That fails “least operational overhead”.
A start-up runs its platform on Amazon EC2 instances in one AWS account.
The security lead wants to be told automatically if an instance starts talking to servers known for cryptocurrency mining, or if the account's AWS credentials are used in an unusual way, such as from an unexpected location. The team is small and does not want to install agents or build its own log analysis.
Which solution meets these requirements?
Choose one answer.
AA. Turn on Amazon Inspector so that it scans the EC2 instances and container images for software vulnerabilities and unintended network exposure.
BB. Turn on Amazon GuardDuty, and send its findings to the team through an Amazon EventBridge rule and an Amazon SNS topic.
CC. Turn on Amazon Detective so that it builds a graph of account activity that the team can explore to investigate suspicious behavior.
DD. Turn on AWS Config with managed rules that flag EC2 instances and IAM resources whose configuration breaks the company's standards.
Show the answer and explanation
Answer: B
A. Wrong: Amazon Inspector finds software vulnerabilities and network exposure in workloads. It reports on weaknesses that could be exploited, not on live suspicious behavior such as mining traffic or odd credential use. GuardDuty is the threat detection service. Learn more: What is Amazon Inspector? (opens in a new tab)
B. Right: Correct. GuardDuty analyses CloudTrail management events, VPC flow logs and DNS logs on its own, with no agents for these sources. It produces findings for cryptomining activity and compromised credentials, and EventBridge can route those findings to an SNS topic for alerts. Learn more: What is Amazon GuardDuty? (opens in a new tab)
C. Wrong: Detective helps analysts investigate the cause and scope of security findings after they are raised. It is not the service that raises alerts in the first place. GuardDuty produces the findings that Detective then helps investigate. Learn more: What is Amazon Detective? (opens in a new tab)
D. Wrong: AWS Config records resource configurations and checks them against rules. It can spot an insecure setting, but it does not watch network traffic or credential use for signs of an attack. GuardDuty covers that. Learn more: What is AWS Config? (opens in a new tab)
Explanation
Amazon GuardDuty is a managed threat detection service. Once turned on, it analyses CloudTrail management events, VPC flow logs and DNS logs without agents, and raises findings for threats such as cryptomining and compromised credentials. Inspector finds vulnerabilities, Detective investigates findings, and Config checks configuration.
A healthcare company stores files in about 600 Amazon S3 buckets spread across 25 member accounts in AWS Organizations. The files include CSV exports, PDFs and JSON logs.
Before a privacy audit, the compliance team must find which buckets hold personal data such as names, addresses and payment card numbers, and must keep checking as teams create new buckets. The team has no data engineers.
Which solution meets these requirements with the LEAST operational effort?
Choose one answer.
AA. Turn on Amazon GuardDuty S3 Protection for the organization, and review the findings that flag unusual access to buckets holding customer files.
BB. Designate a Macie administrator account for the organization, and turn on automated sensitive data discovery for all member accounts.
CC. Catalog every bucket with AWS Glue crawlers, then run Amazon Athena queries with regular expressions that match names, addresses and card numbers.
DD. Run Amazon Comprehend PII detection jobs against the files in each bucket, and collect the results in a central bucket for review.
Show the answer and explanation
Answer: B
A. Wrong: GuardDuty S3 Protection watches object-level API activity for signs of threats such as data exfiltration. It does not look inside objects, so it cannot say which buckets contain personal data. Macie inspects object contents. Learn more: GuardDuty S3 Protection (opens in a new tab)
B. Right: Correct. Amazon Macie uses managed data identifiers to find personal and financial data in many file types. With an organization-wide administrator and automated discovery, it keeps sampling objects across all buckets, including new ones, with no code to write. Learn more: Performing automated sensitive data discovery (opens in a new tab)
C. Wrong: Athena queries structured data, so the PDFs would be missed, and the team would have to write and maintain the patterns and crawlers for 600 buckets. That is a lot of data engineering for a team that has none. Macie does this as a managed service. Learn more: What is Amazon Athena? (opens in a new tab)
D. Wrong: Comprehend can detect personal data in English or Spanish text, but the team would have to start, track and repeat jobs for every bucket and account, including new ones. That is ongoing custom work. Macie's automated discovery covers all buckets on its own. Learn more: Detecting PII entities (opens in a new tab)
Explanation
Amazon Macie discovers sensitive data in Amazon S3. Integrated with AWS Organizations, a Macie administrator can enable it for member accounts, and automated sensitive data discovery continually samples objects across the bucket inventory. GuardDuty watches access rather than contents, and Athena or Comprehend would need custom pipelines.
Want more on Threat detection and data discovery? The 5 full-length practice sets have 10 more Threat detection and data discovery questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →