CCNA Detection Questions

AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

This log entry represents an unauthorized attempt to modify critical infrastructure. To alert on this, one must integrate CloudTrail with Amazon CloudWatch Logs and establish a Metric Filter that matches the 'Denied' status and the 'DeleteTable' action. This pattern is essential for incident response, as it allows security teams to distinguish between accidental user error and potential malicious reconnaissance or destructive intent by an insider.

Amazon Detective automatically collects log data from AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked data set. This allows analysts to visualize and investigate the root cause of security findings by exploring the relationships and activities between users, roles, and IP addresses.

IAM credential reports are the standard way to audit account security. They provide a comprehensive, comma-separated file that contains information about all users in the account and the status of their credentials, including password, access keys, and MFA status. This is critical for security hygiene and compliance, as it allows administrators to proactively disable or remove stale accounts, reducing the risk of unauthorized access via forgotten credentials.

AWS Config is a powerful tool for enforcing compliance with infrastructure policies. By using managed rules like 'ec2-instance-no-public-ip', the engineer can automatically flag any instance that violates the policy. This is a critical detective control for preventing unauthorized network exposure, enabling the team to remediate the violation before a security incident occurs, which is essential for maintaining a hardened, private-by-default cloud environment.

Security Hub Custom Actions allow users to create custom response and remediation workflows. When a custom action is triggered by a user in the console, Security Hub sends the selected finding(s) to Amazon EventBridge. An EventBridge rule then matches the custom action ARN and triggers the associated Lambda function.

AWS GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior. It leverages machine learning to analyze CloudTrail events, VPC Flow Logs, and DNS logs. This is essential for organizations because it identifies threats without requiring the management of complex rule sets, helping teams respond quickly to compromised accounts or malicious instances within the environment.

GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

AWS WAF provides native inspection of web traffic and can detect common patterns of SQL injection. It is the most effective tool to stop these attacks at the edge, before they reach the backend application. Proper configuration of WAF rules is a critical detective and preventative control, ensuring that malicious payloads are identified and filtered in real-time, which protects application databases from compromise and unauthorized data access.

CloudTrail Lake is a managed data lake that simplifies the storage and analysis of CloudTrail events. It eliminates the need to build complex ETL pipelines between S3, Glue, and Athena. It provides a built-in SQL query engine and supports long-term retention policies suitable for compliance requirements.

AWS Security Hub acts as a central hub for security posture management. By aggregating findings from GuardDuty, Inspector, IAM Access Analyzer, and third-party partners, it provides a unified view of security threats. This consolidation is critical for large-scale environments, as it allows security teams to prioritize alerts effectively, reduce operational overhead, and ensure consistent compliance monitoring across the entire organization via AWS Organizations integration.

Amazon GuardDuty provides automated anomaly detection based on CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning to profile typical user behavior and detects deviations such as logins from unusual locations or IP addresses associated with known malicious actors. This is crucial for environments where manual rule creation is impossible due to the sheer volume of users, as it identifies threats without requiring static IP allow-lists.

VPC Traffic Mirroring allows you to copy network traffic from an elastic network interface (ENI) of an EC2 instance and send it to a security appliance for inspection. This is essential for deep packet inspection (DPI), as it provides the actual packet payloads, unlike Flow Logs which only provide metadata.

Amazon Inspector is an automated vulnerability management service. It continuously scans EC2 instances for software vulnerabilities (using the SSM Agent) and network reachability issues. This dual approach ensures that both internal software flaws and external configuration weaknesses are identified and reported to the security team.

GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.

Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect anomalous activities, such as unusual access patterns or data access from unexpected locations. This feature is essential for identifying compromised identities that attempt to mass-download objects. By focusing on data-level events, it provides visibility into malicious behavior that standard API monitoring might miss, ensuring that even authorized users are monitored for activity that deviates from their historical baseline profile.

GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.

IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.