AWS Threat Detection Service for Malicious Activity
Short answer
C Amazon GuardDuty is the AWS service that continuously monitors for malicious activity and unauthorized behavior.
Question
Key Takeaways
The question tests knowledge of AWS security services, specifically distinguishing between monitoring/detection tools like GuardDuty and vulnerability assessment tools like Inspector.
Amazon GuardDuty is the correct AWS service for continuous threat detection of malicious activity and unauthorized behavior across accounts, workloads, and S3 buckets.
Common mistake: Learners often confuse Amazon Inspector with GuardDuty; Inspector focuses on vulnerability management for EC2 instances rather than continuous behavioral threat detection.
Expert Analysis
Why the Answer Is Correct
Amazon GuardDuty is a intelligent threat detection service that continuously monitors your AWS environments for malicious activity and unauthorized behavior. It analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail to identify threats like credential compromise, instance compromise, and unauthorized API usage. This aligns perfectly with the requirement to monitor accounts, workloads, and S3 buckets for malicious activity.
Why the Other Options Are Wrong
AWS Shield is a managed DDoS protection service, not a general threat detection tool for unauthorized behavior. AWS Firewall Manager helps centrally manage firewall rules across accounts but does not perform active threat detection analysis. Amazon Inspector is an automated vulnerability management service that scans Amazon EC2 instances for software vulnerabilities and unintended network exposure, focusing on patching rather than real-time threat intelligence.
Community Comment Notes
The community consensus strongly supports Amazon GuardDuty, with all visible votes selecting option C. Users confirm that GuardDuty is the standard solution for this specific scenario, noting its ability to provide actionable security findings. One user explicitly stated, "C. Amazon GuardDuty Amazon GuardDuty is a threat detection service..." highlighting the direct match to the question's requirements.
Official Reference
https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When asked about 'threat detection' or 'unauthorized behavior', immediately think of GuardDuty. If the question mentions 'vulnerabilities' or 'patching', think Inspector. If it mentions 'DDoS', think Shield. Memorize these primary functions to avoid confusion.
Frequently Asked Questions
Why is Amazon Inspector incorrect for threat detection?
Does GuardDuty monitor S3 buckets?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
thinzarlwin8822 👍 2 Answered CC. Amazon GuardDuty Amazon GuardDuty is a threat detection service that continuously monitors your AWS environment for malicious activity and unauthorized behavior, providing actionable security findings to help you protect your AWS resources.
-
ShaiTay 👍 1 Answered CC. Amazon GuardDuty
-
komorebi 👍 1 Answered CAnswer is C
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →