← CLF-C02·Amazon Web Services

Question 815 of 1,024

Security and Compliance →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is Amazon GuardDuty, which is the correct choice because it uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for unusual activity and threats in AWS. It analyzes VPC Flow Logs, CloudTrail events, and DNS logs to automatically detect threats like EC2 instances communicating with known malicious IPs, unusual API calls indicating credential compromise, or cryptocurrency mining activity. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of AWS security services and their specific monitoring capabilities—GuardDuty is the only service purpose-built for threat detection, not prevention or logging alone. A common trap is confusing GuardDuty with services like AWS Shield (DDoS protection) or AWS Config (resource compliance), so remember: GuardDuty is the detective that finds the bad guys already inside. Memory tip: GuardDuty = Guard + Duty, like a security guard on duty who spots suspicious behavior using ML.

CLF-C02 Security and Compliance Practice Question

This CLF-C02 practice question tests your understanding of security and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A security team wants to automatically detect unusual activity in their AWS account, such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicating credential compromise, or cryptocurrency mining activity. Which AWS service uses machine learning to detect these threats?

Question 1mediummultiple choice

Full question →

A
Amazon Inspector
Why wrong: Inspector scans EC2 instances and container images for software vulnerabilities and network exposure. It does not analyse behaviour logs to detect ongoing malicious activity like crypto mining or compromised credentials.
B
AWS Security Hub
Why wrong: Security Hub aggregates security findings from multiple AWS services (including GuardDuty) into a single dashboard for prioritisation. It does not itself perform the threat detection.
C
Amazon GuardDuty
GuardDuty continuously analyses CloudTrail API logs, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. It detects threats like compromised EC2 instances, unusual API calls, and communication with malicious IPs.
D
Amazon Macie
Why wrong: Macie uses machine learning to discover and protect sensitive data (PII) in S3. It focuses on data classification and privacy, not on detecting behavioural threats like crypto mining.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious or unauthorized behavior in AWS accounts and workloads. It specifically analyzes VPC Flow Logs, AWS CloudTrail management and data events, and DNS logs to detect patterns such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicative of credential compromise, and cryptocurrency mining activity. This makes it the correct choice for the described use case.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon Inspector
Why it's wrong here
Inspector scans EC2 instances and container images for software vulnerabilities and network exposure. It does not analyse behaviour logs to detect ongoing malicious activity like crypto mining or compromised credentials.
✗
AWS Security Hub
Why it's wrong here
Security Hub aggregates security findings from multiple AWS services (including GuardDuty) into a single dashboard for prioritisation. It does not itself perform the threat detection.
✓
Amazon GuardDuty
Why this is correct
GuardDuty continuously analyses CloudTrail API logs, VPC Flow Logs, and DNS logs using machine learning and threat intelligence feeds. It detects threats like compromised EC2 instances, unusual API calls, and communication with malicious IPs.
Related concept
Read the scenario before looking for a memorised answer.
✗
Amazon Macie
Why it's wrong here
Macie uses machine learning to discover and protect sensitive data (PII) in S3. It focuses on data classification and privacy, not on detecting behavioural threats like crypto mining.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Amazon GuardDuty with Amazon Inspector or AWS Security Hub, mistakenly thinking that vulnerability scanning or centralized security findings equate to active threat detection, whereas GuardDuty is the only service that continuously monitors for malicious behavior using machine learning and threat intelligence.

Detailed technical explanation

How to think about this question

GuardDuty leverages a combination of rule-based detection and machine learning models trained on AWS-specific threat intelligence, including the AWS Shield and third-party feeds. For cryptocurrency mining detection, it analyzes patterns in DNS queries (e.g., known mining pool domains) and unusual outbound traffic volumes on ports like 3333, 8333, or 4444. A subtle behavior is that GuardDuty can detect credential compromise by identifying API calls from unusual geographies or times, even if the credentials themselves are valid, using ML-based anomaly detection on CloudTrail events.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CLF-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Cloud Concepts practice questions

Practise CLF-C02 questions linked to Cloud Concepts.

Security and Compliance practice questions

Practise CLF-C02 questions linked to Security and Compliance.

Cloud Technology and Services practice questions

Practise CLF-C02 questions linked to Cloud Technology and Services.

Billing, Pricing, and Support practice questions

Practise CLF-C02 questions linked to Billing, Pricing, and Support.

AWS shared responsibility model practice questions

Practise CLF-C02 questions linked to AWS shared responsibility model.

AWS IAM practice questions

Practise CLF-C02 questions linked to AWS IAM.

AWS pricing practice questions

Practise CLF-C02 questions linked to AWS pricing.

AWS support plans practice questions

Practise CLF-C02 questions linked to AWS support plans.

AWS S3 practice questions

Practise CLF-C02 questions linked to AWS S3.

AWS EC2 practice questions

Practise CLF-C02 questions linked to AWS EC2.

Practice this exam

Start a free CLF-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CLF-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CLF-C02 question test?

Security and Compliance — This question tests Security and Compliance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Amazon GuardDuty — Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious or unauthorized behavior in AWS accounts and workloads. It specifically analyzes VPC Flow Logs, AWS CloudTrail management and data events, and DNS logs to detect patterns such as EC2 instances communicating with known malicious IP addresses, unusual API calls indicative of credential compromise, and cryptocurrency mining activity. This makes it the correct choice for the described use case.

What should I do if I get this CLF-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on CLF-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which AWS service helps detect unusual API activity and potential security threats by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs?

medium

A.AWS Security Hub
B.Amazon Macie
✓ C.Amazon GuardDuty
D.AWS CloudTrail

Why C: Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to identify malicious activity. It analyzes data sources including AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to detect unusual API calls, potentially compromised instances, and other security threats.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.