Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 40 discussion

Answer C

Amazon GuardDuty is a fully managed threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and unauthorized behavior. It uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. Near-Real-Time Monitoring: GuardDuty is designed to analyze data sources like AWS CloudTrail logs, VPC flow logs, and DNS logs in near-real-time. It can detect unusual patterns such as DNS access peaks, abnormal instance traffic, abnormal network interface traffic, and unusual Amazon S3 API calls, which align with the threats identified during the security audit. Answer : C

GuardDuty (C)

C- near-real time -> GuardDuty

Guardduty draw data sources from: AWS CloudTrail logs, VPC flow logs, and DNS logs https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html Only GuardDuty detects abnormal and unusual activities among all choices.

Monitoring threats, abnormal traffic etc always leads towards GuardDuty.