Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 488 discussion

GuardDuty only monitors but doesn't block malicious attempts. So answer is C

Not A because the question only say "Several customers also have access to a legacy API that is running on a single standalone Amazon EC2 instance." There is no ALB or cloudfront mentioned so WAF can't be attached to EC2 directly.

The correct answer is Option C: Use AWS WAF to protect the API Gateway API. Configure Amazon Inspector to analyze the legacy API. Configure Amazon GuardDuty to monitor for malicious attempts to access the APIs. Option C is the right choice because it directly addresses the requirement of increasing security for the API Gateway API by using AWS WAF to protect it from DoS attacks, vulnerabilities, and exploits. It also correctly suggests using Amazon Inspector to assess the security posture of the EC2 instance hosting the legacy API, and configures Amazon GuardDuty to monitor for malicious attempts across both APIs. In contrast, Option A does not explicitly mention protecting the API Gateway API and incorrectly suggests using Inspector to analyze the legacy API application itself.

Option C seems to be correct. In Option B, its mentioned AWS inspector to analyze both the gateway API and EC2 API. AWS inspector cannot directly monitor gateway API, it requires additional WAF configuration for it.

C, for sure. AWS GuardDuty is a monitoring and threat detection service and does not directly block malicious activities. GuardDuty is designed to continuously monitor and analyze your AWS accounts and workloads for potential threats using machine learning, anomaly detection, and integrated threat intelligence.

"The company wants to increase the security for these APIs to better prevent denial of service (DoS) attacks, check for vulnerabilities, and guard against common exploits.", so I understand that we have to protect BOTH, and GuardDuty does not block anything... The answer for me is A

B becuase this protects both API's