A bank's security team wants a managed threat detection service that continuously analyzes account activity and network telemetry for compromised instance credentials, unusual API usage, and cryptocurrency mining, without deploying agents. Which service should be enabled?
Show answer and explanation
Answer: A
Amazon GuardDuty is a managed threat detection service. It analyzes CloudTrail management events, VPC Flow Logs, DNS query logs, and other sources such as S3 and EKS audit logs. It produces findings for compromised credentials, suspicious API calls, and cryptocurrency mining activity, and the base service does not require agents on instances.
Why the other options are wrong
- B. Trusted Advisor checks the account against best-practice categories such as cost, performance, and security configuration. It does not detect active threats or compromised credentials.
- C. AWS Artifact provides compliance reports and agreements for download. It is a document repository, not a detection service.
- D. AWS Config records resource configuration and evaluates compliance against rules. It tracks configuration drift rather than analyzing traffic for malicious behavior.