You have recently migrated your on-premises Datacenter to AWS. You have deployed applications in the EC2 instance launched within a VPC & are using S3 buckets for storing all data. At your on-premises location, you had built a customized tool that would log all activities made by users on servers, a notification service that will notify the Security Team of any changes made to server configuration and a tool to check unsecured ports on applications having risks of accessing from an external network. Security Chief is looking for similar tools that can meet these requirements in AWS infrastructure. Which of the following tools can be used to meet this requirement? (Select Three)

Answer options:

A.Use AWS Config to record API calls to AWS resources.
B.Use AWS Config to track changes in resources with respect to configuration rules.
C.Use AWS CloudTrail to record API calls to AWS resources.
D.Use AWS CloudTrail to track changes in resources with respect to configuration rules.
E.Use Amazon Inspector for security assessment for applications deployed on EC2 instance.
F.Use Amazon GuardDuty for security assessment for applications deployed on EC2 instance.

Correct Answer – B, C, E
AWS Config can be used to track configuration changes done to AWS resources. AWS CloudTrail can be used to record API calls made to AWS resources. Amazon Inspector can be used for assessing vulnerability for any ports & services on applications installed on EC2 instance which can be assessed from external networks.
Option A is incorrect as AWS Config can be used to track configurational changes done to AWS resources & does not record API calls to AWS resources.
Option D is incorrect as AWS CloudTrail can be used to record API calls made to AWS resources & does not track configuration changes to AWS resources.
Option F is incorrect as Amazon GuardDuty does not perform a security assessment of applications deployed on EC2 instance. It is a threat detection service that monitors anomalous behavior in the AWS network using AWS CloudTrail, Amazon VPC Flow Logs, and DNS Logs.
For more information on using tools for Security, refer to the following URL-
https://aws.amazon.com/cloudtrail/faqs/
https://aws.amazon.com/config/faq/
https://aws.amazon.com/inspector/faqs/