Q31 — AWS SAA-C03 Ch.11

Question 31 of 100 | ← Chapter 11

Q731. A company has deployed its newest product on AWS. The product runs in an Auto Scaling group behind a Network Load Balancer. The company stores the product objects in an Amazon S3 bucket.The company recently experienced malicious attacks against its systems. The company needs a solution that continuously monitors for malicious activity in the AWS account, workloads, and access patterns to the S3 bucket. The solution must also report suspicious activity and display the information on a dashboard.Which solution will meet these requirements?

Correct Answer: C. Configure Amazon GuardDuty to monitor and report findings to AWS Security Hub.

Explanation

To meet the requirement of continuously monitoring for malicious activity in the AWS account, workloads, and access patterns to an Amazon S3 bucket, and reporting suspicious activity on a dashboard, the most suitable solution is:C. Configure Amazon GuardDuty to monitor and report findings to AWS Security Hub.Option C, configuring Amazon GuardDuty to monitor and report findings to AWS Security Hub, is the recommended solution to meet the requirements:- Amazon GuardDuty: GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior in your AWS environment. It analyzes events and network traffic to detect various types of threats, including compromised EC2 instances, unauthorized access attempts, and data exfiltration.- AWS Security Hub: Security Hub is a comprehensive security service that provides a centralized view of security alerts and compliance status across your AWS accounts. It aggregates findings from various security services, including GuardDuty, and provides a dashboard for monitoring and managing security events.By configuring GuardDuty, you can enable continuous monitoring for malicious activity within your AWS account and workloads. GuardDuty analyzes network traffic, DNS logs, AWS CloudTrail events, and VPC flow logs to detect potential threats.When GuardDuty detects suspicious activity, it generates findings that are automatically sent to Security Hub. Security Hub then aggregates and displays the findings on its dashboard, providing a centralized view of the security status and allowing you to investigate and respond to potential security incidents.Option A, configuring Amazon Macie to monitor and report findings to AWS Config, is not the most appropriate solution for monitoring and detecting malicious activity. Macie is primarily focused on data security and sensitive data discovery, rather than monitoring for general security threats.Option B, configuring Amazon Inspector to monitor and report findings to AWS CloudTrail, is not the optimal solution for monitoring malicious activity in the AWS account and access patterns to an S3 bucket. Inspector is primarily used for assessing the security and compliance of EC2 instances, rather than monitoring for broader security threats.Option D, configuring AWS Config to monitor and report findings to Amazon EventBridge, is not the recommended solution for monitoring and detecting malicious activity. AWS Config is a service that provides configuration and compliance monitoring for AWS resources, but it does not specialize in threat detection or monitoring for suspicious activity.Therefore, the solution that best meets the requirements is C: Configure Amazon GuardDuty to monitor and report findings to AWS Security Hub. This solution enables continuous monitoring for malicious activity, provides centralized reporting and a dashboard for security events, and meets the requirement of detecting and reporting suspicious activity in the AWS account, workloads, and access patterns to the S3 bucket.