AWS Threat Detection Service for Malicious Activity
A company needs a threat detection service that will continuously monitor its AWS accounts, workloads, and Amazon S3 buckets for malicious activity and unauthorized behavior. Which AWS service meets these requirements?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of AWS security services, specifically distinguishing between monitoring/detection tools like GuardDuty and vulnerability assessment tools like Inspector.
Amazon GuardDuty is the correct AWS service for continuous threat detection of malicious activity and unauthorized behavior across accounts, workloads, and S3 buckets.
Learners often confuse Amazon Inspector with GuardDuty; Inspector focuses on vulnerability management for EC2 instances rather than continuous behavioral threat detection.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon GuardDuty is a intelligent threat detection service that continuously monitors your AWS environments for malicious activity and unauthorized behavior. It analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail to identify threats like credential compromise, instance compromise, and unauthorized API usage. This aligns perfectly with the requirement to monitor accounts, workloads, and S3 buckets for malicious activity.Why the Other Options Are Wrong
AWS Shield is a managed DDoS protection service, not a general threat detection tool for unauthorized behavior. AWS Firewall Manager helps centrally manage firewall rules across accounts but does not perform active threat detection analysis. Amazon Inspector is an automated vulnerability management service that scans Amazon EC2 instances for software vulnerabilities and unintended network exposure, focusing on patching rather than real-time threat intelligence.Community Comment Notes
The community consensus strongly supports Amazon GuardDuty, with all visible votes selecting option C. Users confirm that GuardDuty is the standard solution for this specific scenario, noting its ability to provide actionable security findings. One user explicitly stated, "C. Amazon GuardDuty Amazon GuardDuty is a threat detection service..." highlighting the direct match to the question's requirements.Official Reference
Exam Strategy
When asked about 'threat detection' or 'unauthorized behavior', immediately think of GuardDuty. If the question mentions 'vulnerabilities' or 'patching', think Inspector. If it mentions 'DDoS', think Shield. Memorize these primary functions to avoid confusion.
Frequently Asked Questions
Why is Amazon Inspector incorrect for threat detection?
Inspector performs vulnerability scanning on EC2 instances, not continuous behavioral threat detection across the entire environment.
Does GuardDuty monitor S3 buckets?
Yes, GuardDuty analyzes S3 data events and access logs to detect unusual or unauthorized access patterns in S3 buckets.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →