Threat detection and monitoring
Practise only this domain. 62 questions with explanations, 20 at a time.
Start this domainSample questions
- A container platform team notices a shell process spawned inside a running pod that opened an outbound connection to an unknown host, which is typical of an attacker gaining interactive access. Which threat detection capability watches process and file behavior inside running workloads to catch this?Medium
- A development VPC needs flow records only for denied traffic, stored as cheaply as possible, and the team will query them occasionally with SQL. Which delivery configuration is most economical?Medium
- A security team must retain CloudTrail management events for seven years in a queryable store while minimizing operational overhead. Which approach best meets this requirement?Medium
- A company enabled a CloudTrail organization trail. Where are management events from member accounts delivered?Easy
- CloudTrail log files in S3 are being read by an unexpected IAM principal. Which log source reveals the GetObject calls against the CloudTrail bucket?Hard
- GuardDuty raises a finding that temporary credentials issued to an EC2 instance are being used from an address outside AWS. The security team wants the source address blocked and the stolen sessions invalidated without human delay. What is the recommended approach?Hard
- An analyst needs to filter millions of stored CloudTrail records by principal, event name and time range while investigating an incident. Which approach is most efficient?Easy
- A security team is comparing Amazon Inspector v2 with the original Inspector service. Which capability is newly available in v2 rather than carried over from the classic service?Medium