312-39V2: Certified SOC Analyst v2

Question

SecureTech Inc., a leading cybersecurity-focused organization, runs its critical infrastructure and applications on AWS. The Security Operations Center (SOC) team is responsible for detecting, investigating, and mitigating security threats across its cloud environment.

Recently, the SOC team has noticed an increase in suspicious activity, including unexpected API calls, unusual outbound traffic from instances, and DNS requests to potentially malicious domains. To improve its threat-detection capabilities, the team needs a fully managed AWS security service that can continuously monitor for malicious activity throughout its AWS environment, analyze AWS CloudTrail logs, VPC Flow Logs, and DNS query logs, use machine learning and threat intelligence to identify advanced threats, and deliver actionable security findings to speed response efforts.

Which AWS service is best suited to help SecureTech Inc. proactively detect and respond to security threats in its AWS environment?

Explanation

Amazon GuardDuty is a fully managed, continuous threat-detection service. It analyzes AWS CloudTrail management events, VPC Flow Logs, and DNS logs, and uses machine learning and threat-intelligence feeds to identify suspicious or malicious behavior such as anomalous API activity, unusual network traffic, and communication with known malicious domains or IP addresses. It generates security findings that support investigation and response.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ62

Community Discussion