Several EC2 instances were compromised, and the team must determine where the attacker first entered and how the activity spread. Which service gives the most useful timeline?
Show answer and explanation
Answer: B
Detective assembles CloudTrail, flow log and GuardDuty data into entity profiles and a chronological timeline, so an investigator can start from one compromised instance and see which address contacted it first, which role was used and what other resources were touched. That chain usually reveals the initial entry point.
Athena can answer specific queries, but the investigator must know what to ask and build the joins.
Why the other options are wrong
- A. Athena queries logs you model yourself. It has no prebuilt entity graph or timeline to follow from one resource to another.
- C. Flow logs alone show connections without identity or API context, so the entry point is hard to establish from them by hand.
- D. Security Hub aggregates findings into a list and a score. It does not provide a linked timeline across entities.