Detection practice questions

A security engineer needs to detect unauthorized API calls originating from an EC2 instance that has an attached IAM role. Which service provides the most granular visibility into the identity and the specific API actions performed?

Trap 1: Enable VPC Flow Logs to monitor all inbound and outbound traffic…

VPC Flow Logs capture IP traffic information but do not log the specific AWS API operations performed by the instance. While useful for network traffic analysis and detecting unauthorized data exfiltration destinations, they lack the granularity to identify the specific IAM identity or the API method invoked during an event.

Trap 2: Deploy AWS GuardDuty to monitor network traffic and DNS queries.

GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious behavior. While it can detect unauthorized API calls, it is a managed detection service; it does not provide the raw, granular log data required for a deep forensic investigation into specific API actions.

Trap 3: Configure AWS Config to record resource configuration changes.

AWS Config focuses on resource state and configuration history rather than runtime API activity. While it can detect when an IAM role's policy changes or when an EC2 instance configuration deviates from a baseline, it does not provide an audit trail of individual API calls made by the role.

A
Enable VPC Flow Logs to monitor all inbound and outbound traffic patterns.
Why wrong: VPC Flow Logs capture IP traffic information but do not log the specific AWS API operations performed by the instance. While useful for network traffic analysis and detecting unauthorized data exfiltration destinations, they lack the granularity to identify the specific IAM identity or the API method invoked during an event.
B
Deploy AWS GuardDuty to monitor network traffic and DNS queries.
Why wrong: GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious behavior. While it can detect unauthorized API calls, it is a managed detection service; it does not provide the raw, granular log data required for a deep forensic investigation into specific API actions.
C
Enable AWS CloudTrail management and data events for the account.
CloudTrail management events track actions like creating roles, while data events track activity within specific resources like S3 objects. This provides the exact identity, source IP, and API action performed by the IAM role attached to the EC2 instance, making it the correct choice for granular API visibility.
D
Configure AWS Config to record resource configuration changes.
Why wrong: AWS Config focuses on resource state and configuration history rather than runtime API activity. While it can detect when an IAM role's policy changes or when an EC2 instance configuration deviates from a baseline, it does not provide an audit trail of individual API calls made by the role.

Question 2mediummultiple choice

Refer to the exhibit. A security engineer discovers that an IAM user is successfully accessing data in the 'sensitive-data' bucket despite no explicit Allow rule in their IAM policy for that bucket. Which detective control can identify the source of this permission?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::sensitive-data/*"
    }
  ]
}

Trap 1: Use IAM Access Analyzer to validate the resource-based policy.

IAM Access Analyzer can identify resources that are shared with external entities or identify the specific effective permissions granted to a user. By analyzing the bucket policy in conjunction with the IAM user policy, it can pinpoint that the access is likely granted by a resource-based policy.

Trap 2: Review AWS Config rules for IAM policy compliance violations.

AWS Config is useful for tracking historical configuration changes and compliance against established rules. However, it does not provide an engine to simulate or explain the complex effective permission logic between IAM identity policies and resource-based bucket policies in real-time for troubleshooting access issues.

Trap 3: Run an AWS Trusted Advisor report on IAM role permissions.

Trusted Advisor provides general recommendations for security, such as identifying overly permissive policies or checking for MFA. It does not perform an exhaustive analysis of cross-account access or effective permission evaluation, making it ineffective for diagnosing why a specific user can access a specific S3 bucket.

A
Enable AWS CloudTrail and analyze the 'userIdentity' field in logs.
While CloudTrail logs show that the access occurred, they do not explicitly explain the permission evaluation logic. They capture the identity and the event, but the engineer would still have to manually correlate the event with all relevant policy types to understand why access was granted.
B
Use IAM Access Analyzer to validate the resource-based policy.
Why wrong: IAM Access Analyzer can identify resources that are shared with external entities or identify the specific effective permissions granted to a user. By analyzing the bucket policy in conjunction with the IAM user policy, it can pinpoint that the access is likely granted by a resource-based policy.
C
Review AWS Config rules for IAM policy compliance violations.
Why wrong: AWS Config is useful for tracking historical configuration changes and compliance against established rules. However, it does not provide an engine to simulate or explain the complex effective permission logic between IAM identity policies and resource-based bucket policies in real-time for troubleshooting access issues.
D
Run an AWS Trusted Advisor report on IAM role permissions.
Why wrong: Trusted Advisor provides general recommendations for security, such as identifying overly permissive policies or checking for MFA. It does not perform an exhaustive analysis of cross-account access or effective permission evaluation, making it ineffective for diagnosing why a specific user can access a specific S3 bucket.

Question 3mediummulti select

A company is concerned about sensitive data being accidentally exposed via S3 buckets. Which THREE actions should the security team take to improve detection of such risks?

Trap 1: Enable S3 Block Public Access at the account level.

While this is an excellent preventive control that reduces the surface area for exposure, it is not a detective control. A detective control focuses on monitoring, identifying, and alerting on events after they occur, whereas this control prevents the public access from being established.

Trap 2: Enable AWS Shield to protect the S3 bucket endpoints.

AWS Shield provides protection against DDoS attacks on network infrastructure. It does not monitor or report on the public visibility status of S3 buckets or the contents of objects stored within them, making it irrelevant for detecting sensitive data exposure risks.

A
Enable Amazon Macie to discover sensitive data in S3 buckets.
Macie uses machine learning to identify sensitive data (e.g., PII) in S3. By providing visibility into where sensitive data resides, it helps security teams prioritize the hardening of buckets that contain high-risk information, effectively reducing the impact of accidental exposure.
B
Enable S3 Block Public Access at the account level.
Why wrong: While this is an excellent preventive control that reduces the surface area for exposure, it is not a detective control. A detective control focuses on monitoring, identifying, and alerting on events after they occur, whereas this control prevents the public access from being established.
C
Use AWS Config rules to monitor S3 bucket public accessibility.
AWS Config rules allow for continuous monitoring of resource configurations. By using managed rules like s3-bucket-public-read-prohibited, the team receives alerts when a bucket's configuration changes to allow public access, enabling rapid detection of security misconfigurations across the entire organization.
D
Configure CloudTrail to log all S3 object-level access events.
Enabling S3 data events in CloudTrail provides a detailed audit log of who accessed which object and when. This is critical for forensic investigations and detecting anomalous patterns of access that might indicate that sensitive data has been compromised or exfiltrated by an unauthorized party.
E
Enable AWS Shield to protect the S3 bucket endpoints.
Why wrong: AWS Shield provides protection against DDoS attacks on network infrastructure. It does not monitor or report on the public visibility status of S3 buckets or the contents of objects stored within them, making it irrelevant for detecting sensitive data exposure risks.

Question 4mediummultiple choice

A security auditor needs to track all configuration changes made to VPC Security Groups over the last year. Which service provides a comprehensive, historical audit trail of these changes?

Trap 1: AWS CloudTrail.

CloudTrail logs the API calls that modify the configuration, but it does not provide a simplified view of the resource's configuration state over time. To reconstruct the history of a security group using only CloudTrail, an auditor would need to correlate many disparate API events.

Trap 2: AWS CloudWatch Logs.

CloudWatch Logs stores log streams but does not inherently manage or version resource configuration history. While CloudTrail logs can be sent to CloudWatch, CloudWatch itself does not provide the structured, resource-centric timeline view required for easy auditing of security group rule changes.

Trap 3: AWS Trusted Advisor.

Trusted Advisor evaluates the current state of infrastructure against security and performance best practices. It does not store or provide a historical timeline of configuration changes, making it unsuitable for auditing past modifications to VPC Security Group rules or any other resource configuration changes.

A
AWS CloudTrail.
Why wrong: CloudTrail logs the API calls that modify the configuration, but it does not provide a simplified view of the resource's configuration state over time. To reconstruct the history of a security group using only CloudTrail, an auditor would need to correlate many disparate API events.
B
AWS Config.
AWS Config is designed specifically to capture the configuration history of supported AWS resources. It provides a timeline of changes, enabling the auditor to see exactly when and how a security group was modified, which is the most efficient method for auditing configuration drift over a year.
C
AWS CloudWatch Logs.
Why wrong: CloudWatch Logs stores log streams but does not inherently manage or version resource configuration history. While CloudTrail logs can be sent to CloudWatch, CloudWatch itself does not provide the structured, resource-centric timeline view required for easy auditing of security group rule changes.
D
AWS Trusted Advisor.
Why wrong: Trusted Advisor evaluates the current state of infrastructure against security and performance best practices. It does not store or provide a historical timeline of configuration changes, making it unsuitable for auditing past modifications to VPC Security Group rules or any other resource configuration changes.

Question 5hardmultiple choice

A company wants to detect potential insider threats involving unauthorized data access to S3. They already have CloudTrail enabled. What is the next logical step to enhance detection?

Trap 1: Implement AWS WAF on S3 buckets.

AWS WAF cannot be applied directly to S3 buckets. While it can protect CloudFront distributions that serve as a front-end for S3, it is not a tool for detecting unauthorized access patterns to the underlying S3 objects themselves, making it ineffective for identifying insider threats.

Trap 2: Deploy AWS Inspector to the S3 buckets.

AWS Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities. It does not have the capability to monitor data access patterns in S3 buckets, so it cannot be used to detect or alert on potential insider threats involving data.

Trap 3: Enable AWS Config for all S3 buckets.

AWS Config tracks configuration changes, such as bucket policy modifications or encryption settings. It does not monitor the actual data access patterns (e.g., who is reading which object), which is necessary to detect an insider downloading sensitive files from an S3 bucket they are authorized to access.

A
Enable Amazon GuardDuty with S3 Protection.
GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect suspicious behavior, such as unusual access patterns or data exfiltration from unexpected locations. This provides an automated detection layer on top of raw logs, significantly improving the ability to identify malicious insider activity in real-time.
B
Implement AWS WAF on S3 buckets.
Why wrong: AWS WAF cannot be applied directly to S3 buckets. While it can protect CloudFront distributions that serve as a front-end for S3, it is not a tool for detecting unauthorized access patterns to the underlying S3 objects themselves, making it ineffective for identifying insider threats.
C
Deploy AWS Inspector to the S3 buckets.
Why wrong: AWS Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities. It does not have the capability to monitor data access patterns in S3 buckets, so it cannot be used to detect or alert on potential insider threats involving data.
D
Enable AWS Config for all S3 buckets.
Why wrong: AWS Config tracks configuration changes, such as bucket policy modifications or encryption settings. It does not monitor the actual data access patterns (e.g., who is reading which object), which is necessary to detect an insider downloading sensitive files from an S3 bucket they are authorized to access.

Question 6hardmulti select

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Trap 1: VPC Security Groups.

Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic. This is a preventive control, as it blocks traffic based on defined rules before it ever reaches the instance, rather than detecting or alerting on activity after it has occurred.

Trap 2: IAM User Permissions.

IAM permissions define what actions a user is allowed to perform. This is a preventive control because it enforces the principle of least privilege by restricting access before any action can be taken, thereby preventing unauthorized operations rather than detecting them after they have occurred.

A
AWS CloudTrail.
CloudTrail provides a history of API calls, which is the foundational detective control for auditing account activity. By allowing security teams to reconstruct events after they have occurred, it serves as an indispensable tool for forensic analysis, troubleshooting, and verifying compliance with security policies.
B
VPC Security Groups.
Why wrong: Security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic. This is a preventive control, as it blocks traffic based on defined rules before it ever reaches the instance, rather than detecting or alerting on activity after it has occurred.
C
Amazon GuardDuty.
GuardDuty is a managed detection service that analyzes various data sources to identify threats. It actively monitors for malicious activity and provides findings, making it a primary detective control that alerts teams to potential compromises in real-time, which is essential for rapid incident response.
D
AWS Config.
AWS Config is a detective control that monitors and records resource configurations. It continuously evaluates those configurations against desired states and alerts on drift, allowing teams to identify non-compliant resources and take corrective action, which is a critical aspect of maintaining a secure cloud environment.
E
IAM User Permissions.
Why wrong: IAM permissions define what actions a user is allowed to perform. This is a preventive control because it enforces the principle of least privilege by restricting access before any action can be taken, thereby preventing unauthorized operations rather than detecting them after they have occurred.

Question 7hardmultiple choice

Refer to the exhibit. This CloudTrail event indicates a bucket policy change. Which service could have alerted the team to this change in near real-time?

Exhibit

{
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutBucketPolicy",
  "userIdentity": {
    "arn": "arn:aws:iam::123456789012:user/temp-user"
  }
}

Trap 1: AWS Trusted Advisor.

Trusted Advisor performs periodic checks and does not support real-time alerting on specific API events like 'PutBucketPolicy'. It would not provide the instantaneous notification required to react quickly to a potentially malicious or erroneous change to an S3 bucket's policy.

Trap 2: AWS Inspector.

Inspector is designed for assessing the security of EC2 instances and container images for software vulnerabilities. It has no mechanism for monitoring or alerting on S3 bucket policy changes, making it irrelevant for this specific security requirement regarding S3 bucket permissions.

Trap 3: AWS Config.

Config can detect that a bucket policy has changed, but the notification process is often slower than an EventBridge rule. While it is useful for long-term compliance and remediation, EventBridge is the preferred method for near real-time alerting on specific, critical API actions.

A
Amazon EventBridge.
EventBridge can ingest CloudTrail events in real-time and trigger targets like SNS, Lambda, or SQS. By defining a rule that matches 'PutBucketPolicy', the team can receive an immediate alert, allowing them to verify the change and revert it if it was unauthorized.
B
AWS Trusted Advisor.
Why wrong: Trusted Advisor performs periodic checks and does not support real-time alerting on specific API events like 'PutBucketPolicy'. It would not provide the instantaneous notification required to react quickly to a potentially malicious or erroneous change to an S3 bucket's policy.
C
AWS Inspector.
Why wrong: Inspector is designed for assessing the security of EC2 instances and container images for software vulnerabilities. It has no mechanism for monitoring or alerting on S3 bucket policy changes, making it irrelevant for this specific security requirement regarding S3 bucket permissions.
D
AWS Config.
Why wrong: Config can detect that a bucket policy has changed, but the notification process is often slower than an EventBridge rule. While it is useful for long-term compliance and remediation, EventBridge is the preferred method for near real-time alerting on specific, critical API actions.

Question 8mediummultiple choice

A company requires a detective control to ensure that all EBS volumes are encrypted at rest. Which service is best suited to provide continuous monitoring and remediation of this policy?

Trap 1: AWS CloudTrail.

CloudTrail records the 'CreateVolume' API call, but it does not continuously evaluate the state of all volumes to ensure they remain compliant. It cannot be used to trigger an alert if a volume is created without encryption, nor can it provide a dashboard of compliance status.

Trap 2: Amazon GuardDuty.

GuardDuty is a threat detection service, not a configuration compliance service. It does not monitor the encryption status of storage resources like EBS volumes, so it cannot be used to ensure that all data at rest meets the organization's encryption security requirements.

Trap 3: AWS WAF.

AWS WAF is designed for web application protection by filtering HTTP/S traffic. It is entirely unrelated to the configuration of storage services like EBS, and thus cannot be used to detect or enforce encryption policies for volumes attached to EC2 instances.

A
AWS CloudTrail.
Why wrong: CloudTrail records the 'CreateVolume' API call, but it does not continuously evaluate the state of all volumes to ensure they remain compliant. It cannot be used to trigger an alert if a volume is created without encryption, nor can it provide a dashboard of compliance status.
B
AWS Config.
AWS Config monitors the configuration of resources like EBS volumes. By using managed rules to check for encryption, it provides continuous monitoring and reporting of compliance status, allowing the security team to identify and remediate any unencrypted volumes immediately after they are detected.
C
Amazon GuardDuty.
Why wrong: GuardDuty is a threat detection service, not a configuration compliance service. It does not monitor the encryption status of storage resources like EBS volumes, so it cannot be used to ensure that all data at rest meets the organization's encryption security requirements.
D
AWS WAF.
Why wrong: AWS WAF is designed for web application protection by filtering HTTP/S traffic. It is entirely unrelated to the configuration of storage services like EBS, and thus cannot be used to detect or enforce encryption policies for volumes attached to EC2 instances.

Question 9mediummultiple choice

Which AWS service is best suited for detecting and analyzing malicious network traffic directed at an EC2 instance?

Trap 1: AWS CloudTrail.

CloudTrail logs API activity, not network traffic. While it can show that an instance was created or modified, it does not provide visibility into the packet-level or flow-level network communications, which is required to analyze malicious traffic directed at the instance's IP addresses.

Trap 2: AWS Config.

AWS Config tracks configuration changes to AWS resources. It cannot monitor network traffic in real-time or analyze packets to detect malicious behavior. While it can detect if a security group is overly permissive, it is not a tool for analyzing active network-based attacks.

Trap 3: AWS WAF.

AWS WAF filters web traffic at the application layer for specific web services. It cannot monitor general network traffic, such as SSH or RDP connections, nor can it provide the deep analysis of network patterns required to identify malicious activity originating from external sources.

A
AWS CloudTrail.
Why wrong: CloudTrail logs API activity, not network traffic. While it can show that an instance was created or modified, it does not provide visibility into the packet-level or flow-level network communications, which is required to analyze malicious traffic directed at the instance's IP addresses.
B
Amazon GuardDuty.
GuardDuty monitors VPC Flow Logs to detect malicious network behavior. It can identify threats like unauthorized access attempts, communication with malicious hosts, or unusual traffic patterns, providing the necessary analysis to detect and alert on attacks directed at EC2 instances.
C
AWS Config.
Why wrong: AWS Config tracks configuration changes to AWS resources. It cannot monitor network traffic in real-time or analyze packets to detect malicious behavior. While it can detect if a security group is overly permissive, it is not a tool for analyzing active network-based attacks.
D
AWS WAF.
Why wrong: AWS WAF filters web traffic at the application layer for specific web services. It cannot monitor general network traffic, such as SSH or RDP connections, nor can it provide the deep analysis of network patterns required to identify malicious activity originating from external sources.

Question 10mediummultiple choice

A security engineer needs to centralize GuardDuty findings for a multi-account organization. The goal is to ensure that all current and future accounts in the 'Production' OU have GuardDuty enabled automatically and report to the security account. What is the most efficient way to achieve this?

Trap 1: Enable GuardDuty manually in each account and use an S3 bucket in…

Standalone GuardDuty enablement requires manual setup in every account, which is operationally intensive and prone to human error. It fails to leverage AWS Organizations for governance, making it difficult to ensure that every new account is correctly configured for threat detection across the entire enterprise environment.

Trap 2: Use an IAM role in the master account to invite each member account…

Invitation-based GuardDuty management is a legacy method that preceded Organizations integration. While it allows for member-master relationships, it does not support automatic enablement for new accounts. This leads to higher administrative overhead and the potential for new accounts to remain unprotected for significant periods.

Trap 3: Deploy a CloudFormation StackSet to all accounts in the Production…

CloudFormation StackSets can deploy GuardDuty, but they do not provide the native management features of delegated administration. StackSets require continuous maintenance to ensure they target the correct OUs and do not offer the same seamless integration for aggregating findings into the security account console.

A
Designate the security account as the GuardDuty delegated administrator and enable 'Auto-enable' for the organization.
GuardDuty delegated administration allows the security account to manage member accounts. Auto-enablement ensures that new accounts added to the organization are automatically protected without manual intervention, reducing the risk of coverage gaps. This approach centralizes finding management and billing while maintaining regional compliance and operational efficiency.
B
Enable GuardDuty manually in each account and use an S3 bucket in the security account as a finding export destination.
Why wrong: Standalone GuardDuty enablement requires manual setup in every account, which is operationally intensive and prone to human error. It fails to leverage AWS Organizations for governance, making it difficult to ensure that every new account is correctly configured for threat detection across the entire enterprise environment.
C
Use an IAM role in the master account to invite each member account to a GuardDuty master-member relationship.
Why wrong: Invitation-based GuardDuty management is a legacy method that preceded Organizations integration. While it allows for member-master relationships, it does not support automatic enablement for new accounts. This leads to higher administrative overhead and the potential for new accounts to remain unprotected for significant periods.
D
Deploy a CloudFormation StackSet to all accounts in the Production OU that enables GuardDuty and sets a custom publishing frequency.
Why wrong: CloudFormation StackSets can deploy GuardDuty, but they do not provide the native management features of delegated administration. StackSets require continuous maintenance to ensure they target the correct OUs and do not offer the same seamless integration for aggregating findings into the security account console.

Question 11mediummulti select

An organization wants to use Amazon Macie to protect sensitive data across their S3 environment. Which TWO tasks can Macie perform to help detect and protect this data?

Trap 1: Encrypt unencrypted S3 objects automatically upon discovery.

Macie is a detection and discovery service, not a remediation service. It will alert you to unencrypted buckets or sensitive data, but it does not modify the objects or apply encryption itself. Remediation must be performed via AWS Config, Lambda, or manual administrative actions.

Trap 2: Block S3 'GetObject' requests if they contain sensitive data.

Macie does not sit in the data path and cannot block real-time access requests to S3 objects. It performs out-of-band analysis of the data. To block access based on content, you would need to use a proxy or pre-process data before it is stored in S3.

Trap 3: Monitor VPC Flow Logs for data exfiltration patterns from EC2.

Monitoring VPC Flow Logs for exfiltration is a function of Amazon GuardDuty. Macie is strictly focused on discovering and protecting data at rest within Amazon S3. It does not analyze network traffic or monitor EC2 instance behavior for security threats or data movement.

A
Automatically discover and classify sensitive data like credit card numbers and PII.
Macie uses a combination of managed data identifiers (like patterns for SSNs or credit cards) and custom data identifiers to scan S3 objects. This automated classification helps organizations understand where their most sensitive data resides so they can apply appropriate security controls and compliance measures.
B
Provide a security posture overview of S3 buckets, identifying public or unencrypted buckets.
Macie provides an inventory of your S3 buckets and evaluates them for security risks. It identifies buckets that are publicly accessible, shared with external accounts, or lack encryption. This allows security teams to prioritize remediation for the most exposed storage resources in the organization.
C
Encrypt unencrypted S3 objects automatically upon discovery.
Why wrong: Macie is a detection and discovery service, not a remediation service. It will alert you to unencrypted buckets or sensitive data, but it does not modify the objects or apply encryption itself. Remediation must be performed via AWS Config, Lambda, or manual administrative actions.
D
Block S3 'GetObject' requests if they contain sensitive data.
Why wrong: Macie does not sit in the data path and cannot block real-time access requests to S3 objects. It performs out-of-band analysis of the data. To block access based on content, you would need to use a proxy or pre-process data before it is stored in S3.
E
Monitor VPC Flow Logs for data exfiltration patterns from EC2.
Why wrong: Monitoring VPC Flow Logs for exfiltration is a function of Amazon GuardDuty. Macie is strictly focused on discovering and protecting data at rest within Amazon S3. It does not analyze network traffic or monitor EC2 instance behavior for security threats or data movement.

Question 12mediummultiple choice

An organization requires centralized detection of malicious activity across multiple AWS accounts. Which architecture is best for managing GuardDuty findings at scale?

Trap 1: Manually enable GuardDuty in every individual account.

Manually enabling services in each account is operationally inefficient and prone to configuration drift. It is highly likely that new accounts will be provisioned without security coverage, creating significant blind spots. An enterprise-grade detection strategy must leverage AWS Organizations for automated service deployment and centralized security governance across all accounts.

Trap 2: Forward all GuardDuty findings to a central S3 bucket using…

While this pattern allows for log aggregation, it is complex to implement and lacks the native integration benefits of the GuardDuty delegated administrator. It requires custom logic for ingestion, parsing, and alerting. GuardDuty's native multi-account features simplify this architecture by aggregating findings automatically into the security account console.

Trap 3: Deploy GuardDuty in the management account only.

Deploying security services in the management account is a violation of the principle of least privilege and general AWS best practices. The management account should be kept separate from operational security activities to prevent accidental exposure of core organizational governance controls. Always use a dedicated security account for security management.

A
Manually enable GuardDuty in every individual account.
Why wrong: Manually enabling services in each account is operationally inefficient and prone to configuration drift. It is highly likely that new accounts will be provisioned without security coverage, creating significant blind spots. An enterprise-grade detection strategy must leverage AWS Organizations for automated service deployment and centralized security governance across all accounts.
B
Use a delegated administrator account via AWS Organizations.
The delegated administrator model allows a designated security account to manage GuardDuty for the entire organization. This ensures automated enabling of the service for existing and new accounts, providing a unified dashboard for security analysts to triage findings without needing access to individual member accounts, streamlining detection and response.
C
Forward all GuardDuty findings to a central S3 bucket using cross-account roles.
Why wrong: While this pattern allows for log aggregation, it is complex to implement and lacks the native integration benefits of the GuardDuty delegated administrator. It requires custom logic for ingestion, parsing, and alerting. GuardDuty's native multi-account features simplify this architecture by aggregating findings automatically into the security account console.
D
Deploy GuardDuty in the management account only.
Why wrong: Deploying security services in the management account is a violation of the principle of least privilege and general AWS best practices. The management account should be kept separate from operational security activities to prevent accidental exposure of core organizational governance controls. Always use a dedicated security account for security management.

Question 13hardmulti select

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Trap 1: Use AWS Shield Standard to mitigate Layer 7 application attacks.

AWS Shield Standard is designed specifically for protecting against Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks. It does not provide the application-level logic required to detect or block specific brute-force authentication attempts occurring at the web application layer.

Trap 2: Enable AWS Trusted Advisor to monitor for open security groups.

Trusted Advisor provides recommendations for optimizing performance and cost, as well as general security best practices like identifying open security groups. While useful for overall hygiene, it is not a detective control for real-time brute-force authentication attacks against specific web application endpoints.

Trap 3: Implement AWS Inspector to scan for vulnerabilities on the…

AWS Inspector performs vulnerability assessments by scanning EC2 instances for software vulnerabilities and network reachability issues. It does not monitor runtime authentication logs or detect brute-force patterns, making it unsuitable for detecting active credential-based attacks occurring against your web application endpoints.

A
Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.
Rate-based rules in AWS WAF automatically track the number of requests from specific IP addresses over a rolling five-minute period. When a threshold is breached, the WAF can automatically block requests from those IPs, providing an effective first line of defense against automated brute-force login attempts.
B
Use AWS Shield Standard to mitigate Layer 7 application attacks.
Why wrong: AWS Shield Standard is designed specifically for protecting against Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks. It does not provide the application-level logic required to detect or block specific brute-force authentication attempts occurring at the web application layer.
C
Configure CloudWatch Logs agents to stream system auth logs to CloudWatch.
Streaming system authentication logs (such as /var/log/auth.log) to CloudWatch Logs allows for the creation of metric filters. These filters can trigger CloudWatch Alarms when a specific number of failed login attempts are detected within a time window, alerting security teams to brute-force activity occurring on the instance.
D
Enable AWS Trusted Advisor to monitor for open security groups.
Why wrong: Trusted Advisor provides recommendations for optimizing performance and cost, as well as general security best practices like identifying open security groups. While useful for overall hygiene, it is not a detective control for real-time brute-force authentication attacks against specific web application endpoints.
E
Implement AWS Inspector to scan for vulnerabilities on the instances.
Why wrong: AWS Inspector performs vulnerability assessments by scanning EC2 instances for software vulnerabilities and network reachability issues. It does not monitor runtime authentication logs or detect brute-force patterns, making it unsuitable for detecting active credential-based attacks occurring against your web application endpoints.

Question 14mediummultiple choice

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Trap 1: AWS CloudWatch Dashboards.

CloudWatch Dashboards are highly customizable for visualizing metrics and logs but are not designed as a native security finding aggregator. They lack the specific integration with AWS security services required to ingest, deduplicate, and normalize security findings from across multiple accounts into a structured format.

Trap 2: AWS Systems Manager OpsCenter.

OpsCenter is intended for the investigation and remediation of operational issues in AWS resources. While it can track operational tasks, it is not intended to serve as a consolidated dashboard for security findings originating from specialized threat detection services like GuardDuty or Inspector.

Trap 3: AWS Config Advanced Query.

Config Advanced Query is used for resource discovery and assessing configuration states against rules. It is not an alerting or finding aggregation tool. It does not provide the centralized dashboarding capabilities required to manage and prioritize active security threats identified by various detection services.

A
AWS CloudWatch Dashboards.
Why wrong: CloudWatch Dashboards are highly customizable for visualizing metrics and logs but are not designed as a native security finding aggregator. They lack the specific integration with AWS security services required to ingest, deduplicate, and normalize security findings from across multiple accounts into a structured format.
B
AWS Security Hub.
Security Hub is specifically designed to aggregate, organize, and prioritize security alerts and findings from various AWS services and partner products. It offers a centralized dashboard that provides a comprehensive view of the security state across all accounts in an AWS Organization, fulfilling the requirement.
C
AWS Systems Manager OpsCenter.
Why wrong: OpsCenter is intended for the investigation and remediation of operational issues in AWS resources. While it can track operational tasks, it is not intended to serve as a consolidated dashboard for security findings originating from specialized threat detection services like GuardDuty or Inspector.
D
AWS Config Advanced Query.
Why wrong: Config Advanced Query is used for resource discovery and assessing configuration states against rules. It is not an alerting or finding aggregation tool. It does not provide the centralized dashboarding capabilities required to manage and prioritize active security threats identified by various detection services.

Question 15easymultiple choice

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Trap 1: AWS Macie.

AWS Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3. While it detects sensitive data exposure, it is not the primary service for detecting anomalous API activity or unauthorized access patterns across the entire AWS infrastructure.

Trap 2: AWS WAF.

AWS WAF is a web application firewall that protects web applications from common exploits and bots. It filters HTTP/S traffic based on rules, but it does not perform machine learning-based analysis of internal AWS API activity or account-level anomalous behaviors like unauthorized S3 access.

Trap 3: AWS CloudTrail.

CloudTrail records API activity logs but does not inherently use machine learning to detect anomalous behavior. It provides the data that other services like GuardDuty analyze, but on its own, it is a logging and auditing service, not an intelligent threat detection engine.

A
AWS Macie.
Why wrong: AWS Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data in S3. While it detects sensitive data exposure, it is not the primary service for detecting anomalous API activity or unauthorized access patterns across the entire AWS infrastructure.
B
AWS GuardDuty.
GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to monitor and protect AWS accounts. It is specifically designed to identify anomalous activity, such as unusual API calls or unauthorized access to sensitive resources like S3 buckets, based on baseline behavioral patterns.
C
AWS WAF.
Why wrong: AWS WAF is a web application firewall that protects web applications from common exploits and bots. It filters HTTP/S traffic based on rules, but it does not perform machine learning-based analysis of internal AWS API activity or account-level anomalous behaviors like unauthorized S3 access.
D
AWS CloudTrail.
Why wrong: CloudTrail records API activity logs but does not inherently use machine learning to detect anomalous behavior. It provides the data that other services like GuardDuty analyze, but on its own, it is a logging and auditing service, not an intelligent threat detection engine.

Question 16hardmultiple choice

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Exhibit

2023-10-27T10:00:00Z | User: Admin | Action: DeleteTable | Resource: DynamoDB | Status: Denied

Trap 1: Amazon GuardDuty.

GuardDuty is optimized for identifying anomalous patterns like unusual API calls or credential theft, but it does not allow users to define custom metric filters for specific log patterns. It would not specifically alert on a single 'Denied' event unless that event is part of a larger, suspicious behavioral pattern.

Trap 2: AWS Security Hub.

While Security Hub aggregates findings, it does not act as the primary engine for creating custom alerts based on raw log patterns. To get an alert into Security Hub, the log must first be processed by another service, such as CloudWatch or Lambda, to generate a formal finding.

Trap 3: AWS Trusted Advisor.

Trusted Advisor checks for resource optimization and security best practices, but it does not monitor real-time API logs or provide alerting capabilities for specific denied events within an account. It is not designed to function as an incident detection tool for API authorization failures.

A
Amazon GuardDuty.
Why wrong: GuardDuty is optimized for identifying anomalous patterns like unusual API calls or credential theft, but it does not allow users to define custom metric filters for specific log patterns. It would not specifically alert on a single 'Denied' event unless that event is part of a larger, suspicious behavioral pattern.
B
Amazon CloudWatch Metric Filters and Alarms.
CloudWatch Metric Filters allow users to search CloudTrail logs for specific patterns, such as denied API calls. Once a pattern is matched, a metric can be incremented and an alarm can be configured to notify security personnel, providing an automated way to detect high-risk denied actions.
C
AWS Security Hub.
Why wrong: While Security Hub aggregates findings, it does not act as the primary engine for creating custom alerts based on raw log patterns. To get an alert into Security Hub, the log must first be processed by another service, such as CloudWatch or Lambda, to generate a formal finding.
D
AWS Trusted Advisor.
Why wrong: Trusted Advisor checks for resource optimization and security best practices, but it does not monitor real-time API logs or provide alerting capabilities for specific denied events within an account. It is not designed to function as an incident detection tool for API authorization failures.

Question 17mediummultiple choice

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

Trap 1: AWS CloudTrail.

CloudTrail captures the API call that launched the instance, but it does not provide an ongoing, real-time assessment of the instance's state. It would be difficult to query for every currently running instance that has a public IP without complex log analysis and state correlation.

Trap 2: Amazon GuardDuty.

GuardDuty monitors for malicious activity and threats, such as unusual traffic or compromised credentials. It is not designed to alert on basic configuration states, such as whether an EC2 instance has a public IP, as that is a policy compliance issue rather than a threat.

Trap 3: AWS Systems Manager.

Systems Manager is an operational tool for managing resources, patching, and running commands. While it can be used to query instance states, it does not have the built-in, continuous compliance monitoring and alerting framework that AWS Config provides for detecting unauthorized configuration states.

A
AWS CloudTrail.
Why wrong: CloudTrail captures the API call that launched the instance, but it does not provide an ongoing, real-time assessment of the instance's state. It would be difficult to query for every currently running instance that has a public IP without complex log analysis and state correlation.
B
AWS Config.
AWS Config provides managed rules that continuously monitor resource configurations. By evaluating instances against the 'ec2-instance-no-public-ip' rule, it can automatically detect and alert on any instance that has an assigned public IP, fulfilling the requirement for automated detection of network exposure.
C
Amazon GuardDuty.
Why wrong: GuardDuty monitors for malicious activity and threats, such as unusual traffic or compromised credentials. It is not designed to alert on basic configuration states, such as whether an EC2 instance has a public IP, as that is a policy compliance issue rather than a threat.
D
AWS Systems Manager.
Why wrong: Systems Manager is an operational tool for managing resources, patching, and running commands. While it can be used to query instance states, it does not have the built-in, continuous compliance monitoring and alerting framework that AWS Config provides for detecting unauthorized configuration states.

Question 18mediummultiple choice

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

Trap 1: AWS CloudTrail.

CloudTrail tracks API activity, but it would be extremely inefficient to manually parse thousands of logs to determine if a specific user has performed an action in the last 90 days. The Credential Report provides this data in a single, aggregated format specifically for this purpose.

Trap 2: AWS Config.

AWS Config monitors resource configuration history, but it does not track IAM user login activity or credential usage. It is designed to track changes to IAM policies or other AWS resources, not the usage metrics for individual IAM user credentials over time.

Trap 3: AWS Trusted Advisor.

Trusted Advisor provides a check for 'IAM Access Key Rotation' and 'MFA on Root Account', but it does not provide a custom report on the usage status of all IAM users over a specific timeframe like 90 days. It is not the correct tool for this task.

A
AWS CloudTrail.
Why wrong: CloudTrail tracks API activity, but it would be extremely inefficient to manually parse thousands of logs to determine if a specific user has performed an action in the last 90 days. The Credential Report provides this data in a single, aggregated format specifically for this purpose.
B
IAM Credential Report.
The IAM Credential Report generates a report that lists all users and includes fields like 'password_last_used' and 'access_key_1_last_used'. This is the most direct and efficient way to identify users who haven't performed any actions in a specific time frame for compliance auditing.
C
AWS Config.
Why wrong: AWS Config monitors resource configuration history, but it does not track IAM user login activity or credential usage. It is designed to track changes to IAM policies or other AWS resources, not the usage metrics for individual IAM user credentials over time.
D
AWS Trusted Advisor.
Why wrong: Trusted Advisor provides a check for 'IAM Access Key Rotation' and 'MFA on Root Account', but it does not provide a custom report on the usage status of all IAM users over a specific timeframe like 90 days. It is not the correct tool for this task.

Question 19easymultiple choice

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Trap 1: Amazon CloudWatch ServiceLens

CloudWatch ServiceLens is primarily focused on application performance monitoring and tracing across distributed systems. It provides visibility into service health and dependencies but is not designed to aggregate security findings or provide a centralized security posture management dashboard for security-specific alerts.

Trap 2: AWS Trusted Advisor

Trusted Advisor provides recommendations for cost optimization, performance, and security best practices, but it does not act as a real-time finding aggregator. It lacks the deep integration with services like Macie or GuardDuty for detailed threat detection and incident management required for security operations.

Trap 3: AWS Config Aggregator

AWS Config Aggregators collect configuration data and compliance status from multiple accounts and regions. While useful for compliance auditing, they do not aggregate threat-based findings from services like GuardDuty. Security Hub is the appropriate tool for aggregating security alerts and threat detections.

A
Amazon CloudWatch ServiceLens
Why wrong: CloudWatch ServiceLens is primarily focused on application performance monitoring and tracing across distributed systems. It provides visibility into service health and dependencies but is not designed to aggregate security findings or provide a centralized security posture management dashboard for security-specific alerts.
B
AWS Security Hub
Security Hub acts as a central repository for security findings from various AWS services and partner tools. It automatically normalizes finding data into the AWS Security Finding Format (ASFF), allowing security teams to analyze and respond to threats more efficiently across multiple accounts and regions.
C
AWS Trusted Advisor
Why wrong: Trusted Advisor provides recommendations for cost optimization, performance, and security best practices, but it does not act as a real-time finding aggregator. It lacks the deep integration with services like Macie or GuardDuty for detailed threat detection and incident management required for security operations.
D
AWS Config Aggregator
Why wrong: AWS Config Aggregators collect configuration data and compliance status from multiple accounts and regions. While useful for compliance auditing, they do not aggregate threat-based findings from services like GuardDuty. Security Hub is the appropriate tool for aggregating security alerts and threat detections.

Question 20hardmultiple choice

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Trap 1: GuardDuty EKS Audit Log Monitoring

EKS Audit Log Monitoring analyzes the Kubernetes API server logs to detect suspicious administrative actions at the cluster level. While important, it does not provide visibility into what is happening inside the running containers, such as shell execution or file system modifications.

Trap 2: Amazon Inspector Container Scanning

Amazon Inspector scans container images for known software vulnerabilities (CVEs) and package issues during build or when stored in ECR. It is a proactive vulnerability management tool rather than a reactive detection tool for runtime behavioral anomalies or active container compromises.

Trap 3: VPC Traffic Mirroring for EKS Worker Nodes

VPC Traffic Mirroring captures network packets for deep packet inspection. While it can help detect network-based threats, it does not provide insights into process execution or file system activity within the container, making it less effective for detecting runtime-level compromises compared to Runtime Monitoring.

A
GuardDuty EKS Audit Log Monitoring
Why wrong: EKS Audit Log Monitoring analyzes the Kubernetes API server logs to detect suspicious administrative actions at the cluster level. While important, it does not provide visibility into what is happening inside the running containers, such as shell execution or file system modifications.
B
GuardDuty Runtime Monitoring
Runtime Monitoring uses a security agent to collect telemetry from individual containers and the underlying host. It identifies malicious behavior by monitoring system calls, providing detection for threats like crypto-mining, reverse shells, and privilege escalation that happen during the execution phase of a container.
C
Amazon Inspector Container Scanning
Why wrong: Amazon Inspector scans container images for known software vulnerabilities (CVEs) and package issues during build or when stored in ECR. It is a proactive vulnerability management tool rather than a reactive detection tool for runtime behavioral anomalies or active container compromises.
D
VPC Traffic Mirroring for EKS Worker Nodes
Why wrong: VPC Traffic Mirroring captures network packets for deep packet inspection. While it can help detect network-based threats, it does not provide insights into process execution or file system activity within the container, making it less effective for detecting runtime-level compromises compared to Runtime Monitoring.