1.2 - Detect threats and anomalies with AWS services (GuardDuty, Inspector, Macie, Detective, Security Hub)

1. An automation account normally issues a few dozen API calls per hour. Last night it issued several thousand DescribeInstances calls in ten minutes. Which capability is designed to surface exactly this kind of deviation?

• AWS Config, which would have recorded a new configuration item for each of the instances that the calls described during that window
• Amazon Macie, whose sensitivity scoring would have risen for the buckets that the automation account is allowed to read from
• CloudTrail Insights (correct answer)
• AWS Trusted Advisor, whose service limit checks warn an account approaching the throttling threshold of an API

CloudTrail Insights learns the normal call rate of each API in the account and raises an Insights event when the volume departs from that baseline, which is precisely a burst of enumeration calls. Config records configuration state and not call volume, Macie inspects data content, and Trusted Advisor compares an account with best practices rather than with its own history.

2. A team wants GuardDuty to see process level activity inside its EC2 instances and containers, such as a shell spawned by a web server. What does this require?

• Nothing, since GuardDuty already observes process execution through the CloudTrail management events produced by the account
• Enabling VPC Flow Logs on every subnet, because process activity is inferred from the network connections that each process opens
• Sending the operating system logs of each instance to CloudWatch Logs, where GuardDuty subscribes to the log groups it needs
• Enabling Runtime Monitoring, which deploys the GuardDuty security agent (correct answer)

Runtime Monitoring is the one GuardDuty capability that is not agentless: it installs a security agent that reports process, file and network events from inside the host or the container. Log based sources such as CloudTrail and Flow Logs never see what happens inside the operating system, and GuardDuty does not consume arbitrary CloudWatch log groups.

3. A security team wants CloudTrail, VPC Flow Logs, Route 53 logs and third party sources in one place, converted to a common schema for analysis. Which service does this?

• Amazon Detective, which already ingests several of these sources in order to build the behaviour graph it presents to an analyst
• AWS Config, whose aggregator gathers the configuration items of every account and Region into a single view for the organization
• Amazon Security Lake, which normalises sources into OCSF (correct answer)
• Amazon CloudWatch, whose cross account observability links the log groups and metrics of several accounts to a monitoring account

Security Lake centralises security data in your own S3 storage and converts it to the Open Cybersecurity Schema Framework, so any analytics tool can query it uniformly. Detective builds its own closed graph rather than a queryable lake, Config only handles configuration items, and CloudWatch links log groups without converting them to a common security schema.

4. A security team wants continuous threat detection across an account without deploying any software on the EC2 fleet. Which service meets the requirement?

• Amazon Inspector, which continuously scans running workloads for known software vulnerabilities and network reachability issues
• Amazon Macie, which discovers and classifies sensitive data stored in Amazon S3 buckets
• Amazon GuardDuty (correct answer)
• AWS Config, which records resource configuration changes and evaluates them against rules

GuardDuty reads data sources that AWS already produces, such as CloudTrail management and data events, VPC Flow Logs and DNS query logs, so it needs no agent at all. Inspector looks for software vulnerabilities rather than active threats, Macie is about sensitive data classification in S3, and Config tracks configuration drift rather than attacker behaviour.

5. Which service aggregates findings from GuardDuty, Inspector and Macie into a single normalised view with compliance standards?

• Amazon Detective, which builds an interactive investigation graph from the events surrounding a finding
• AWS CloudTrail Lake, which stores immutable event records and lets you query them with SQL
• Amazon EventBridge, which routes events between sources and targets according to rules you define
• AWS Security Hub (correct answer)

Security Hub ingests findings in the AWS Security Finding Format and adds standards such as CIS and the AWS Foundational Security Best Practices. Detective investigates one finding in depth instead of aggregating many, CloudTrail Lake is a query store for API activity, and EventBridge only moves events without normalising or scoring them.

6. GuardDuty raises a finding of type CryptoCurrency:EC2/BitcoinTool.B!DNS. Which data source produced it?

• Route 53 resolver DNS query logs (correct answer)
• Amazon Inspector vulnerability scan results collected from the SSM agent installed on the instance
• AWS Config configuration items describing the security groups attached to the instance
• Amazon Macie classification jobs run against the S3 buckets that the instance writes to

The !DNS suffix in a GuardDuty finding type names the data source, here the DNS query logs of the VPC resolver, which showed the instance resolving a known mining pool domain. Inspector, Config and Macie are not GuardDuty data sources at all, and none of them observes outbound name resolution.