A company security team would like to receive notifications if an EC2 instance in their AWS environment is querying IP addresses that are associated with cryptocurrency-related (Bitcoin) activity.What steps can the security team take to achieve this most efficiently? (SELECT TWO.)

Answer options:

A.Install Amazon Inspector Agent.
B.Enable Amazon GuardDuty.
C.Create a CloudWatch Log group.
D.Create a new CloudTrail.
E.Subscribe to an SNS Topic.

Answer: B and E
Option A is incorrect because Amazon Inspector performs network and EC2 host assessment for common security vulnerabilities such as ones defined in the CIS Security Benchmarks. It does not help in this scenario.
Option B is CORRECT because GuardDuty can perform an assessment of network communication and produce “CryptoCurrency:EC2/BitcoinTool.B” finding when an EC2 instance is querying an IP address(es) that is associated with Bitcoin.
Option C is incorrect because a new CloudWatch Logs group is not efficient in finding the EC2 instance that is querying certain IP addresses.
Option D is incorrect because CloudTrail is used to trace the API activities and cannot check if an EC2 instance is querying certain IP addresses.
Option E is CORRECT because the SNS topic can be used to provide notifications.
Reference:
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_crypto.html#crypto4
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html