4.3 - Threat detection and protection (GuardDuty, WAF, Shield)

1. Which TWO of the following are valid actions that a CloudWatch metric alarm can invoke directly? (Choose TWO.)

• Publish a notification to an Amazon SNS topic (correct answer)
• Execute an EC2 stop, terminate, reboot, or recover action (correct answer)
• Directly rewrite the affected instance's security group inbound rules
• Roll back the most recent CloudFormation stack update automatically

A metric alarm can notify an SNS topic and perform EC2 actions (stop/terminate/reboot/recover), plus Auto Scaling and Systems Manager actions. It cannot directly edit security groups or roll back CloudFormation stacks.

2. A launch template must define EBS volumes that are encrypted at rest for every instance the group launches. What should the template specify?

• A security group allowing all traffic
• Encrypted EBS volumes with a KMS key (correct answer)
• A public IP on every instance
• A NAT gateway route for the subnet

Specifying encrypted EBS volumes with a KMS key in the block device mapping ensures every launched instance has encryption at rest. Security groups, public IPs, and NAT routes concern networking, not volume encryption.

3. Security wants to see accepted and rejected traffic for a VPC without any host agent. What do you enable?

• CloudTrail data events for every elastic network interface in the VPC
• VPC Flow Logs sending records to a CloudWatch log group (correct answer)
• The unified CloudWatch agent on every instance to sniff packets locally
• Route 53 query logging, which also records inbound VPC packet decisions

VPC Flow Logs capture accepted/rejected IP traffic metadata at the network level and can deliver to CloudWatch Logs, needing no host agent. CloudTrail records API calls, the agent needs installation, and Route 53 query logs record DNS, not packets.

4. For a security audit you must record the DNS names your resources resolve through a Route 53 resolver. What produces this?

• VPC Flow Logs, which include the resolved hostname for each connection
• CloudWatch agent DNS collection enabled in the metrics section of its config
• Route 53 Resolver query logging delivered to a CloudWatch log group (correct answer)
• CloudTrail management events, which log every DNS lookup made in the account

Route 53 Resolver query logging records the DNS queries made from your VPC and can send them to CloudWatch Logs. Flow Logs show IPs not hostnames, the agent has no DNS query log feature, and CloudTrail does not capture DNS lookups.

5. For cross-account observability, which controls exactly which source accounts a monitoring account may link to?

• The observability sink policy in the monitoring account (correct answer)
• A security group attached to each of the source accounts individually
• A NACL on the monitoring account's default VPC
• The bucket policy of the artifacts S3 bucket

The sink in the monitoring account has a resource policy that specifies which source accounts or organization paths may create links to it, governing the trust boundary. Security groups and NACLs are network controls, and a bucket policy governs S3 access, not observability links.

6. A compliance rule requires that any instance flagged by GuardDuty be network-isolated within minutes automatically. Which design meets it?

• Email the security team so an analyst isolates it manually
• A weekly audit that reviews GuardDuty findings in batch
• EventBridge on the finding invoking a runbook that swaps the SG (correct answer)
• A GuardDuty trusted IP list that permanently ignores the flagged instance

An EventBridge rule on the GuardDuty finding invoking an SSM Automation runbook that replaces the security group isolates the instance automatically within minutes. Manual email, weekly audits, and trusted IP lists are slow or counterproductive.