A security team wants continuous, automated detection of suspicious activity, such as unusual API calls or communication with known-malicious IP addresses, using existing VPC Flow Logs, DNS query logs, and CloudTrail events, without deploying any agent on their instances. Which service fits this need?
- AWS Config, configured with custom rules that scan flow logs hourly
- Amazon GuardDuty, which continuously analyzes VPC Flow Logs, DNS query logs, and CloudTrail events using threat intelligence to generate findings without requiring any agent installation
- AWS Systems Manager Inventory, which lists installed software on managed instances
- Amazon Inspector, whose vulnerability scans are focused on detecting network intrusions rather than software vulnerabilities
Why B? And why not the others?
Correct answer: B. Amazon GuardDuty, which continuously analyzes VPC Flow Logs, DNS query logs, and CloudTrail events using threat intelligence to generate findings without requiring any agent installation
Amazon GuardDuty is a managed threat-detection service that continuously analyzes existing log sources — VPC Flow Logs, DNS query logs, and CloudTrail management and data events — against threat intelligence feeds and anomaly-detection models to generate findings, and it requires no agent to be installed on any instance because it consumes logs and events that AWS services already produce. The option describing AWS Config is wrong because Config evaluates resource configuration compliance against rules; it is not designed to analyze network flow or DNS data for malicious activity, and it does not work by scanning flow logs hourly. The option describing Systems Manager Inventory is wrong because Inventory simply catalogs metadata like installed applications and OS details on managed instances; it performs no threat analysis at all. The option describing Amazon Inspector is wrong because Inspector's actual purpose is the reverse of what is stated: it is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a tool focused on detecting active network intrusions in the way GuardDuty is.
Source: Amazon GuardDuty documentation: What is Amazon GuardDuty