You just joined an IT security team in a large financial company. Your company is a heavy user of AWS and owns a large number of AWS resources including EC2, S3, RDS, etc. In order to monitor the services from security perspective, your team is required to create a continuous monitoring service in AWS. For example, the service should be able to identify potential risks if an EC2 instance is compromised and is used to perform a Denial of Service (DoS) attack using UDP protocol. Which approach should you take?

Answer options:

A.Use AWS GuardDuty to continuously monitor AWS services. GuardDuty can detect security issues and generate findings in console or through Amazon CloudWatch events.
B.Enable AWS Macie to continuously scan AWS security risks in resources such as EC2. It can identify potential issues and provide alarms such as if an EC2 instance is compromised.
C.Enable AWS Enterprise support plan and activate full features of Trusted Advisor which can quickly provide alarms for security related issue.
D.Activate VPC Flow Logs, AWS CloudTrail event logs, and DNS logs and transfer the logs to a dedicated S3 bucket. Configure Athena to query the logs to identify potential security problems.

Correct Answer – A
According to
https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html, Amazon GuardDuty is a security service that can continuously monitor and analyze data resources including VPC Flow Logs, AWS CloudTrail event logs, and DNS logs.
Option A is CORRECT: Because GuardDuty is able to process log files and provide security alarms. Below is an example when GuardDuty has found a high risk alarm when an EC2 instance may be used to perform a Denial of Service (DoS) attack using UDP protocol on TCP port:
Option B is incorrect: Because Macie mainly deals with data in S3 bucket. For example, it can find out PII data in a S3 file. GuardDuty is more appropriate in this case.
Option C is incorrect: The security feature of Trusted Advisor can be regarded as a supplement however it only provides a limited check and can not scan security issues for the whole system.
Option D is incorrect: Athena can be used to scan S3 buckets using SQL commands. However this case requires a continuous monitoring tool. Athena is not applicable for this task.